deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: KeyBoy_876_0x4e20000
Repository: Neo23x0/signature-base
Detects: Detects KeyBoy Backdoor
Author: Markus Neis, Florian Roth
Reference: https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/

Pattern signatures:
$x1 = "%s\\rundll32.exe %s ServiceTake %s %s" fullword ascii
      $x2 = "#%sCmd shell is not running,or your cmd is error!" fullword ascii
      $x3 = "Take Screen Error,May no user login!" fullword ascii
      $x4 = "Get logon user fail!" fullword ascii
      $x5 = "8. LoginPasswd:%s" fullword ascii
      $x6 = "Take Screen Error,service dll not exists" fullword ascii

      $s1 = "taskkill /f /pid %s" fullword ascii
      $s2 = "TClient.exe" fullword ascii
      $s3 = "%s\\wab32res.dll" fullword ascii
      $s4 = "%s\\rasauto.dll" fullword ascii
      $s5 = "Download file:%s index:%d" fullword ascii
      $s6 = "LogonUser: [%s]" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 2000KB and (
        1 of ($x*) or
        3 of them
      )

Full rule:
rule KeyBoy_876_0x4e20000 {
   meta:
      description = "Detects KeyBoy Backdoor"
      author = "Markus Neis, Florian Roth"
      reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
      date = "2018-03-26"
      hash1 = "6e900e5b6dc4f21a004c5b5908c81f055db0d7026b3c5e105708586f85d3e334"
      id = "0b871f62-0f7c-5c94-9b3d-f68832ab64b4"
   strings:
      $x1 = "%s\\rundll32.exe %s ServiceTake %s %s" fullword ascii
      $x2 = "#%sCmd shell is not running,or your cmd is error!" fullword ascii
      $x3 = "Take Screen Error,May no user login!" fullword ascii
      $x4 = "Get logon user fail!" fullword ascii
      $x5 = "8. LoginPasswd:%s" fullword ascii
      $x6 = "Take Screen Error,service dll not exists" fullword ascii

      $s1 = "taskkill /f /pid %s" fullword ascii
      $s2 = "TClient.exe" fullword ascii
      $s3 = "%s\\wab32res.dll" fullword ascii
      $s4 = "%s\\rasauto.dll" fullword ascii
      $s5 = "Download file:%s index:%d" fullword ascii
      $s6 = "LogonUser: [%s]" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 2000KB and (
        1 of ($x*) or
        3 of them
      )
}
YARA Detection Rule: EXPL_Log4j_CallBackDomain_IOCs_Dec21_1
Repository: Neo23x0/signature-base
Detects: Detects IOCs found in Log4Shell incidents that indicate exploitation attempts of CVE-2021-44228
Author: Florian Roth (Nextron Systems)
Reference: https://gist.github.com/superducktoes/9b742f7b44c71b4a0d19790228ce85d8

Pattern signatures:
$xr1  = /\b(ldap|rmi):\/\/([a-z0-9\.]{1,16}\.bingsearchlib\.com|[a-z0-9\.]{1,40}\.interact\.sh|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}):[0-9]{2,5}\/([aZ]|ua|Exploit|callback|[0-9]{10}|http443useragent|http80useragent)\b/

Detection condition:
1 of them

Full rule:
rule EXPL_Log4j_CallBackDomain_IOCs_Dec21_1 {
   meta:
      description = "Detects IOCs found in Log4Shell incidents that indicate exploitation attempts of CVE-2021-44228"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://gist.github.com/superducktoes/9b742f7b44c71b4a0d19790228ce85d8"
      date = "2021-12-12"
      score = 60
      id = "474afa96-1758-587e-8cab-41c5205e245e"
   strings:
      $xr1  = /\b(ldap|rmi):\/\/([a-z0-9\.]{1,16}\.bingsearchlib\.com|[a-z0-9\.]{1,40}\.interact\.sh|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}):[0-9]{2,5}\/([aZ]|ua|Exploit|callback|[0-9]{10}|http443useragent|http80useragent)\b/
   condition:
      1 of them
}
YARA Detection Rule: EXPL_JNDI_Exploit_Patterns_Dec21_1
Repository: Neo23x0/signature-base
Detects: Detects JNDI Exploit Kit patterns in files
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/pimps/JNDI-Exploit-Kit

Pattern signatures:
$x01 = "/Basic/Command/Base64/"
      $x02 = "/Basic/ReverseShell/"
      $x03 = "/Basic/TomcatMemshell"
      $x04 = "/Basic/JettyMemshell"
      $x05 = "/Basic/WeblogicMemshell"
      $x06 = "/Basic/JBossMemshell"
      $x07 = "/Basic/WebsphereMemshell"
      $x08 = "/Basic/SpringMemshell"
      $x09 = "/Deserialization/URLDNS/"
      $x10 = "/Deserialization/CommonsCollections1/Dnslog/"
      $x11 = "/Deserialization/CommonsCollections2/Command/Base64/"
      $x12 = "/Deserialization/CommonsBeanutils1/ReverseShell/"
      $x13 = "/Deserialization/Jre8u20/TomcatMemshell"
      $x14 = "/TomcatBypass/Dnslog/"
      $x15 = "/TomcatBypass/Command/"
      $x16 = "/TomcatBypass/ReverseShell/"
      $x17 = "/TomcatBypass/TomcatMemshell"
      $x18 = "/TomcatBypass/SpringMemshell"
      $x19 = "/GroovyBypass/Command/"
      $x20 = "/WebsphereBypass/Upload/"

      $fp1 = "<html"

Detection condition:
1 of ($x*) and not 1 of ($fp*)

Full rule:
rule EXPL_JNDI_Exploit_Patterns_Dec21_1 {
   meta:
      description = "Detects JNDI Exploit Kit patterns in files"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/pimps/JNDI-Exploit-Kit"
      date = "2021-12-12"
      score = 60
      id = "a9127dd2-b818-5ca8-877a-3c47b1e92606"
   strings:
      $x01 = "/Basic/Command/Base64/"
      $x02 = "/Basic/ReverseShell/"
      $x03 = "/Basic/TomcatMemshell"
      $x04 = "/Basic/JettyMemshell"
      $x05 = "/Basic/WeblogicMemshell"
      $x06 = "/Basic/JBossMemshell"
      $x07 = "/Basic/WebsphereMemshell"
      $x08 = "/Basic/SpringMemshell"
      $x09 = "/Deserialization/URLDNS/"
      $x10 = "/Deserialization/CommonsCollections1/Dnslog/"
      $x11 = "/Deserialization/CommonsCollections2/Command/Base64/"
      $x12 = "/Deserialization/CommonsBeanutils1/ReverseShell/"
      $x13 = "/Deserialization/Jre8u20/TomcatMemshell"
      $x14 = "/TomcatBypass/Dnslog/"
      $x15 = "/TomcatBypass/Command/"
      $x16 = "/TomcatBypass/ReverseShell/"
      $x17 = "/TomcatBypass/TomcatMemshell"
      $x18 = "/TomcatBypass/SpringMemshell"
      $x19 = "/GroovyBypass/Command/"
      $x20 = "/WebsphereBypass/Upload/"

      $fp1 = "<html"
   condition:
      1 of ($x*) and not 1 of ($fp*)
}
YARA Detection Rule: EXPL_Log4j_CVE_2021_44228_JAVA_Exception_Dec21_1
Repository: Neo23x0/signature-base
Detects: Detects exceptions found in server logs that indicate an exploitation attempt of CVE-2021-44228
Author: Florian Roth (Nextron Systems)
Reference: https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b

Pattern signatures:
$xa1 = "header with value of BadAttributeValueException: "
      
      $sa1 = ".log4j.core.net.JndiManager.lookup(JndiManager"
      $sa2 = "Error looking up JNDI resource"

Detection condition:
$xa1 or all of ($sa*)

Full rule:
rule EXPL_Log4j_CVE_2021_44228_JAVA_Exception_Dec21_1 {
   meta:
      description = "Detects exceptions found in server logs that indicate an exploitation attempt of CVE-2021-44228"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b"
      date = "2021-12-12"
      score = 60
      id = "82cf337e-4ea1-559b-a7b8-512a07adf06f"
   strings:
      $xa1 = "header with value of BadAttributeValueException: "
      
      $sa1 = ".log4j.core.net.JndiManager.lookup(JndiManager"
      $sa2 = "Error looking up JNDI resource"
   condition:
      $xa1 or all of ($sa*)
}
YARA Detection Rule: EXPL_Log4j_CVE_2021_44228_Dec21_Soft
Repository: Neo23x0/signature-base
Detects: Detects indicators in server logs that indicate an exploitation attempt of CVE-2021-44228
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/h113sdx/status/[PII_REDACTED]83661568?s=20

Pattern signatures:
$x01 = "${jndi:ldap:/"
      $x02 = "${jndi:rmi:/"
      $x03 = "${jndi:ldaps:/"
      $x04 = "${jndi:dns:/"
      $x05 = "${jndi:iiop:/"
      $x06 = "${jndi:http:/"
      $x07 = "${jndi:nis:/"
      $x08 = "${jndi:nds:/"
      $x09 = "${jndi:corba:/"

      $fp1 = "<html"
      $fp2 = "/nessus}"

Detection condition:
1 of ($x*) and not 1 of ($fp*)

Full rule:
rule EXPL_Log4j_CVE_2021_44228_Dec21_Soft : FILE {
   meta:
      description = "Detects indicators in server logs that indicate an exploitation attempt of CVE-2021-44228"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/h113sdx/status/[PII_REDACTED]83661568?s=20"
      date = "2021-12-10"
      modified = "2025-03-24"
      score = 50
      id = "87e536a5-cc11-528a-b100-4fa3b2b7bc0c"
   strings:
      $x01 = "${jndi:ldap:/"
      $x02 = "${jndi:rmi:/"
      $x03 = "${jndi:ldaps:/"
      $x04 = "${jndi:dns:/"
      $x05 = "${jndi:iiop:/"
      $x06 = "${jndi:http:/"
      $x07 = "${jndi:nis:/"
      $x08 = "${jndi:nds:/"
      $x09 = "${jndi:corba:/"

      $fp1 = "<html"
      $fp2 = "/nessus}"
   condition:
      1 of ($x*) and not 1 of ($fp*)
}
YARA Detection Rule: EXPL_Log4j_CVE_2021_44228_Dec21_OBFUSC
Repository: Neo23x0/signature-base
Detects: Detects obfuscated indicators in server logs that indicate an exploitation attempt of CVE-2021-44228
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/h113sdx/status/[PII_REDACTED]83661568?s=20

Pattern signatures:
$x1 = "$%7Bjndi:"
      $x2 = "%2524%257Bjndi"
      $x3 = "%2F%252524%25257Bjndi%3A"
      $x4 = "${jndi:${lower:"
      $x5 = "${::-j}${"
      $x6 = "${${env:BARFOO:-j}"
      $x7 = "${::-l}${::-d}${::-a}${::-p}"
      $x8 = "${base64:JHtqbmRp"

      $fp1 = "<html"

Detection condition:
1 of ($x*) and not 1 of ($fp*)

Full rule:
rule EXPL_Log4j_CVE_2021_44228_Dec21_OBFUSC {
   meta:
      description = "Detects obfuscated indicators in server logs that indicate an exploitation attempt of CVE-2021-44228"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/h113sdx/status/[PII_REDACTED]83661568?s=20"
      date = "2021-12-12"
      modified = "2021-12-13"
      score = 60
      id = "d7c4092a-6ffc-5a89-b73a-f7f0ac984cbd"
   strings:
      $x1 = "$%7Bjndi:"
      $x2 = "%2524%257Bjndi"
      $x3 = "%2F%252524%25257Bjndi%3A"
      $x4 = "${jndi:${lower:"
      $x5 = "${::-j}${"
      $x6 = "${${env:BARFOO:-j}"
      $x7 = "${::-l}${::-d}${::-a}${::-p}"
      $x8 = "${base64:JHtqbmRp"

      $fp1 = "<html"
   condition:
      1 of ($x*) and not 1 of ($fp*)
}
YARA Detection Rule: EXPL_Log4j_CVE_2021_44228_Dec21_Hard
Repository: Neo23x0/signature-base
Detects: Detects indicators in server logs that indicate the exploitation of CVE-2021-44228
Author: Florian Roth
Reference: https://twitter.com/h113sdx/status/[PII_REDACTED]83661568?s=20

Pattern signatures:
$x1 = /\$\{jndi:(ldap|ldaps|rmi|dns|iiop|http|nis|nds|corba):\/[\/]?[a-z-\.0-9]{3,120}:[0-9]{2,5}\/[a-zA-Z\.]{1,32}\}/
      $x2 = "Reference Class Name: foo"
      $fp1r = /(ldap|rmi|ldaps|dns):\/[\/]?(127\.0\.0\.1|192\.168\.|172\.[1-3][0-9]\.|10\.)/

      $fpg2 = "<html"
      $fpg3 = "<HTML"
      
      $fp1 = "/QUALYSTEST" ascii
      $fp2 = "w.nessus.org/nessus"
      $fp3 = "/nessus}"

Detection condition:
1 of ($x*) and not 1 of ($fp*)

Full rule:
rule EXPL_Log4j_CVE_2021_44228_Dec21_Hard : FILE {
   meta:
      description = "Detects indicators in server logs that indicate the exploitation of CVE-2021-44228"
      author = "Florian Roth"
      reference = "https://twitter.com/h113sdx/status/[PII_REDACTED]83661568?s=20"
      date = "2021-12-10"
      modified = "2025-03-20"
      score = 65
      id = "5297c42d-7138-507d-a3eb-153afe522816"
   strings:
      $x1 = /\$\{jndi:(ldap|ldaps|rmi|dns|iiop|http|nis|nds|corba):\/[\/]?[a-z-\.0-9]{3,120}:[0-9]{2,5}\/[a-zA-Z\.]{1,32}\}/
      $x2 = "Reference Class Name: foo"
      $fp1r = /(ldap|rmi|ldaps|dns):\/[\/]?(127\.0\.0\.1|192\.168\.|172\.[1-3][0-9]\.|10\.)/

      $fpg2 = "<html"
      $fpg3 = "<HTML"
      
      $fp1 = "/QUALYSTEST" ascii
      $fp2 = "w.nessus.org/nessus"
      $fp3 = "/nessus}"
   condition:
      1 of ($x*) and not 1 of ($fp*)
}
YARA Detection Rule: SUSP_Base64_Encoded_Exploit_Indicators_Dec21
Repository: Neo23x0/signature-base
Detects: Detects base64 encoded strings found in payloads of exploits against log4j CVE-2021-44228
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/Reelix/status/[PII_REDACTED]43071493

Pattern signatures:
/* curl -s  */
      $sa1 = "Y3VybCAtcy"
      $sa2 = "N1cmwgLXMg"
      $sa3 = "jdXJsIC1zI"
      /* |wget -q -O-  */
      $sb1 = "fHdnZXQgLXEgLU8tI"
      $sb2 = "x3Z2V0IC1xIC1PLS"
      $sb3 = "8d2dldCAtcSAtTy0g"

      $fp1 = "<html"

Detection condition:
1 of ($sa*) and 1 of ($sb*)
      and not 1 of ($fp*)

Full rule:
rule SUSP_Base64_Encoded_Exploit_Indicators_Dec21 {
   meta:
      description = "Detects base64 encoded strings found in payloads of exploits against log4j CVE-2021-44228"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/Reelix/status/[PII_REDACTED]43071493"
      date = "2021-12-10"
      modified = "2021-12-13"
      score = 70
      id = "09abc4f0-ace7-5f53-b1d3-5f5c6bf3bdba"
   strings:
      /* curl -s  */
      $sa1 = "Y3VybCAtcy"
      $sa2 = "N1cmwgLXMg"
      $sa3 = "jdXJsIC1zI"
      /* |wget -q -O-  */
      $sb1 = "fHdnZXQgLXEgLU8tI"
      $sb2 = "x3Z2V0IC1xIC1PLS"
      $sb3 = "8d2dldCAtcSAtTy0g"

      $fp1 = "<html"
   condition:
      1 of ($sa*) and 1 of ($sb*)
      and not 1 of ($fp*)
}
YARA Detection Rule: SUSP_JDNIExploit_Indicators_Dec21
Repository: Neo23x0/signature-base
Detects: Detects indicators of JDNI usage in log files and other payloads
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/flypig5211/JNDIExploit

Pattern signatures:
$xr1 = /(ldap|ldaps|rmi|dns|iiop|http|nis|nds|corba):\/\/[a-zA-Z0-9\.]{7,80}:[0-9]{2,5}\/(Basic\/Command\/Base64|Basic\/ReverseShell|Basic\/TomcatMemshell|Basic\/JBossMemshell|Basic\/WebsphereMemshell|Basic\/SpringMemshell|Basic\/Command|Deserialization\/CommonsCollectionsK|Deserialization\/CommonsBeanutils|Deserialization\/Jre8u20\/TomcatMemshell|Deserialization\/CVE_2020_2555\/WeblogicMemshell|TomcatBypass|GroovyBypass|WebsphereBypass)\//

Detection condition:
filesize < 100MB and $xr1

Full rule:
rule SUSP_JDNIExploit_Indicators_Dec21 {
   meta:
      description = "Detects indicators of JDNI usage in log files and other payloads"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/flypig5211/JNDIExploit"
      date = "2021-12-10"
      modified = "2021-12-12"
      score = 70
      id = "2df8b8f3-8d8d-5982-8c85-692b7d91ebb2"
   strings:
      $xr1 = /(ldap|ldaps|rmi|dns|iiop|http|nis|nds|corba):\/\/[a-zA-Z0-9\.]{7,80}:[0-9]{2,5}\/(Basic\/Command\/Base64|Basic\/ReverseShell|Basic\/TomcatMemshell|Basic\/JBossMemshell|Basic\/WebsphereMemshell|Basic\/SpringMemshell|Basic\/Command|Deserialization\/CommonsCollectionsK|Deserialization\/CommonsBeanutils|Deserialization\/Jre8u20\/TomcatMemshell|Deserialization\/CVE_2020_2555\/WeblogicMemshell|TomcatBypass|GroovyBypass|WebsphereBypass)\//
   condition:
      filesize < 100MB and $xr1
}
YARA Detection Rule: SUSP_EXPL_OBFUSC_Dec21_1
Repository: Neo23x0/signature-base
Detects: Detects obfuscation methods used to evade detection in log4j exploitation attempt of CVE-2021-44228
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/testanull/status/[PII_REDACTED]21348609

Pattern signatures:
/* ${lower:X} - single character match */
      $f1 = { 24 7B 6C 6F 77 65 72 3A ?? 7D }
      /* ${upper:X} - single character match */
      $f2 = { 24 7B 75 70 70 65 72 3A ?? 7D }
      /* URL encoded lower - obfuscation in URL */
      $x3 = "$%7blower:"
      $x4 = "$%7bupper:"
      $x5 = "%24%7bjndi:"
      $x6 = "$%7Blower:"
      $x7 = "$%7Bupper:"
      $x8 = "%24%7Bjndi:"

      $fp1 = "<html"

Detection condition:
( 
         1 of ($x*) or 
         filesize < 200KB and 1 of ($f*) 
      ) 
      and not 1 of ($fp*)

Full rule:
rule SUSP_EXPL_OBFUSC_Dec21_1{
   meta:
      description = "Detects obfuscation methods used to evade detection in log4j exploitation attempt of CVE-2021-44228"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/testanull/status/[PII_REDACTED]21348609"
      date = "2021-12-11"
      modified = "2022-11-08"
      score = 60
      id = "b8f56711-7922-54b9-9ce2-6ba05d64c80d"
   strings:
      /* ${lower:X} - single character match */
      $f1 = { 24 7B 6C 6F 77 65 72 3A ?? 7D }
      /* ${upper:X} - single character match */
      $f2 = { 24 7B 75 70 70 65 72 3A ?? 7D }
      /* URL encoded lower - obfuscation in URL */
      $x3 = "$%7blower:"
      $x4 = "$%7bupper:"
      $x5 = "%24%7bjndi:"
      $x6 = "$%7Blower:"
      $x7 = "$%7Bupper:"
      $x8 = "%24%7Bjndi:"

      $fp1 = "<html"
   condition:
      ( 
         1 of ($x*) or 
         filesize < 200KB and 1 of ($f*) 
      ) 
      and not 1 of ($fp*)
}
YARA Detection Rule: SUSP_JDNIExploit_Error_Indicators_Dec21_1
Repository: Neo23x0/signature-base
Detects: Detects error messages related to JDNI usage in log files that can indicate a Log4Shell / Log4j exploitation
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/marcioalm/status/[PII_REDACTED]05875200?s=20

Pattern signatures:
$x1 = "FATAL log4j - Message: BadAttributeValueException: "

Detection condition:
1 of them

Full rule:
rule SUSP_JDNIExploit_Error_Indicators_Dec21_1 {
   meta:
      description = "Detects error messages related to JDNI usage in log files that can indicate a Log4Shell / Log4j exploitation"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/marcioalm/status/[PII_REDACTED]05875200?s=20"
      date = "2021-12-10"
      modified = "2023-06-23"
      score = 70
      id = "68bcf043-58b4-54a9-b024-64871b5d535f"
   strings:
      $x1 = "FATAL log4j - Message: BadAttributeValueException: "
   condition:
      1 of them
}
YARA Detection Rule: Win7Elevatev2
Repository: Neo23x0/signature-base
Detects: Detects Win7Elevate - Windows UAC bypass utility
Author: Florian Roth (Nextron Systems)
Reference: http://www.pretentiousname.com/misc/W7E_Source/Win7Elevate_Inject.cpp.html

Pattern signatures:
$x1 = "This program attempts to bypass Windows 7's default UAC settings to run " wide
		$x2 = "Win7ElevateV2\\x64\\Release\\" ascii
		$x3 = "Run the command normally (without code injection)" wide
		$x4 = "Inject file copy && elevate command" fullword wide
		$x5 = "http://www.pretentiousname.com/misc/win7_uac_whitelist2.html" fullword wide
		$x6 = "For injection, pick any unelevated Windows process with ASLR on:" fullword wide

		$s1 = "\\cmd.exe" wide
		$s2 = "runas" wide
		$s3 = "explorer.exe" wide
		$s4 = "Couldn't load kernel32.dll" wide
		$s5 = "CRYPTBASE.dll" wide
		$s6 = "shell32.dll" wide
		$s7 = "ShellExecuteEx" ascii
		$s8 = "COMCTL32.dll" ascii
		$s9 = "ShellExecuteEx" ascii
		$s10 = "HeapAlloc" ascii

Detection condition:
uint16(0) == 0x5a4d and ( 1 of ($x*) or all of ($s*) )

Full rule:
rule Win7Elevatev2 {
	meta:
		description = "Detects Win7Elevate - Windows UAC bypass utility"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.pretentiousname.com/misc/W7E_Source/Win7Elevate_Inject.cpp.html"
		date = "2015-05-14"
		hash1 = "4f53ff6a04e46eda92b403faf42219a545c06c29" /* x64 */
		hash2 = "808d04c187a524db402c5b2be17ce799d2654bd1" /* x86 */
		score = 60
		id = "af092d16-ca95-5985-822a-50457c9cbcc9"
	strings:
		$x1 = "This program attempts to bypass Windows 7's default UAC settings to run " wide
		$x2 = "Win7ElevateV2\\x64\\Release\\" ascii
		$x3 = "Run the command normally (without code injection)" wide
		$x4 = "Inject file copy && elevate command" fullword wide
		$x5 = "http://www.pretentiousname.com/misc/win7_uac_whitelist2.html" fullword wide
		$x6 = "For injection, pick any unelevated Windows process with ASLR on:" fullword wide

		$s1 = "\\cmd.exe" wide
		$s2 = "runas" wide
		$s3 = "explorer.exe" wide
		$s4 = "Couldn't load kernel32.dll" wide
		$s5 = "CRYPTBASE.dll" wide
		$s6 = "shell32.dll" wide
		$s7 = "ShellExecuteEx" ascii
		$s8 = "COMCTL32.dll" ascii
		$s9 = "ShellExecuteEx" ascii
		$s10 = "HeapAlloc" ascii
	condition:
		uint16(0) == 0x5a4d and ( 1 of ($x*) or all of ($s*) )
}
YARA Detection Rule: UACME_Akagi
Repository: Neo23x0/signature-base
Detects: Rule to detect UACMe - abusing built-in Windows AutoElevate backdoor
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/hfiref0x/UACME

Pattern signatures:
$x1 = "UACMe injected, Fubuki at your service." wide fullword
		$x3 = "%temp%\\Hibiki.dll" fullword wide
		$x4 = "[UCM] Cannot write to the target process memory." fullword wide

		$s1 = "%systemroot%\\system32\\cmd.exe" wide
		$s2 = "D:(A;;GA;;;WD)" wide
		$s3 = "%systemroot%\\system32\\sysprep\\sysprep.exe" fullword wide
		$s4 = "/c wusa %ws /extract:%%windir%%\\system32" fullword wide
		$s5 = "Fubuki.dll" ascii fullword

		$l1 = "ntdll.dll" ascii
		$l2 = "Cabinet.dll" ascii
		$l3 = "GetProcessHeap" ascii
		$l4 = "WriteProcessMemory" ascii
		$l5 = "ShellExecuteEx" ascii

Detection condition:
( 1 of ($x*) ) or ( 3 of ($s*) and all of ($l*) )

Full rule:
rule UACME_Akagi {
	meta:
		description = "Rule to detect UACMe - abusing built-in Windows AutoElevate backdoor"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/hfiref0x/UACME"
		date = "2015-05-14"
		hash1 = "edd2138bbd9e76c343051c6dc898054607f2040a"
		hash2 = "e3a919ccc2e759e618208ededa8a543954d49f8a"
		score = 60
		id = "7979129e-99a3-522a-8285-9061e1e2bd41"
	strings:
		$x1 = "UACMe injected, Fubuki at your service." wide fullword
		$x3 = "%temp%\\Hibiki.dll" fullword wide
		$x4 = "[UCM] Cannot write to the target process memory." fullword wide

		$s1 = "%systemroot%\\system32\\cmd.exe" wide
		$s2 = "D:(A;;GA;;;WD)" wide
		$s3 = "%systemroot%\\system32\\sysprep\\sysprep.exe" fullword wide
		$s4 = "/c wusa %ws /extract:%%windir%%\\system32" fullword wide
		$s5 = "Fubuki.dll" ascii fullword

		$l1 = "ntdll.dll" ascii
		$l2 = "Cabinet.dll" ascii
		$l3 = "GetProcessHeap" ascii
		$l4 = "WriteProcessMemory" ascii
		$l5 = "ShellExecuteEx" ascii
	condition:
		( 1 of ($x*) ) or ( 3 of ($s*) and all of ($l*) )
}
YARA Detection Rule: UACElevator
Repository: Neo23x0/signature-base
Detects: UACElevator bypassing UAC - file UACElevator.exe
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/MalwareTech/UACElevator

Pattern signatures:
$x1 = "\\UACElevator.pdb" ascii

		$s1 = "%userprofile%\\Downloads\\dwmapi.dll" fullword ascii
		$s2 = "%windir%\\system32\\dwmapi.dll" fullword ascii
		$s3 = "Infection module: %s" fullword ascii
		$s4 = "Could not save module to %s" fullword ascii
		$s5 = "%s%s%p%s%ld%s%d%s" fullword ascii
		$s6 = "Stack area around _alloca memory reserved by this function is corrupted" fullword ascii
		$s7 = "Stack around the variable '" fullword ascii
		$s8 = "MSVCR120D.dll" fullword wide
		$s9 = "Address: 0x" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 172KB and
			( $x1 or 8 of ($s*) )

Full rule:
rule UACElevator {
	meta:
		description = "UACElevator bypassing UAC - file UACElevator.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/MalwareTech/UACElevator"
		date = "2015-05-14"
		hash = "fd29d5a72d7a85b7e9565ed92b4d7a3884defba6"
		id = "629b1a92-726d-5713-ae3d-74cc8a1e52ad"
	strings:
		$x1 = "\\UACElevator.pdb" ascii

		$s1 = "%userprofile%\\Downloads\\dwmapi.dll" fullword ascii
		$s2 = "%windir%\\system32\\dwmapi.dll" fullword ascii
		$s3 = "Infection module: %s" fullword ascii
		$s4 = "Could not save module to %s" fullword ascii
		$s5 = "%s%s%p%s%ld%s%d%s" fullword ascii
		$s6 = "Stack area around _alloca memory reserved by this function is corrupted" fullword ascii
		$s7 = "Stack around the variable '" fullword ascii
		$s8 = "MSVCR120D.dll" fullword wide
		$s9 = "Address: 0x" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 172KB and
			( $x1 or 8 of ($s*) )
}