deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: HKTL_NET_NAME_C2Bridge
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/cobbr/C2Bridge

Pattern signatures:
$name = "C2Bridge" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_C2Bridge {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/cobbr/C2Bridge"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "357051aa-61ea-5454-a996-b4e3a45ac865"
    strings:
        $name = "C2Bridge" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_Infrastructure_Assessment
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/NyaMeeEain/Infrastructure-Assessment

Pattern signatures:
$name = "Infrastructure-Assessment" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_Infrastructure_Assessment {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/NyaMeeEain/Infrastructure-Assessment"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "efacc12b-92b3-5b22-b5bb-cd5a7d7eea0e"
    strings:
        $name = "Infrastructure-Assessment" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_shellcodeTester
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/tophertimzen/shellcodeTester

Pattern signatures:
$name = "shellcodeTester" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_shellcodeTester {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/tophertimzen/shellcodeTester"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "964093a4-e6d7-51b7-928a-b1cd40dc11cc"
    strings:
        $name = "shellcodeTester" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_gray_hat_csharp_code
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/brandonprry/gray_hat_csharp_code

Pattern signatures:
$name = "gray_hat_csharp_code" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_gray_hat_csharp_code {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/brandonprry/gray_hat_csharp_code"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "0a94cadc-cc7b-5817-8788-bb1e53937fad"
    strings:
        $name = "gray_hat_csharp_code" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_NativePayload_ReverseShell
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/DamonMohammadbagher/NativePayload_ReverseShell

Pattern signatures:
$name = "NativePayload_ReverseShell" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_NativePayload_ReverseShell {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/DamonMohammadbagher/NativePayload_ReverseShell"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "eec77c09-02db-5d74-8526-e201d2fe6fc8"
    strings:
        $name = "NativePayload_ReverseShell" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_DotNetAVBypass
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/mandreko/DotNetAVBypass

Pattern signatures:
$name = "DotNetAVBypass" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_DotNetAVBypass {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/mandreko/DotNetAVBypass"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "918eba2b-150d-5e69-bed0-0979ae889165"
    strings:
        $name = "DotNetAVBypass" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_HexyRunner
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/bao7uo/HexyRunner

Pattern signatures:
$name = "HexyRunner" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_HexyRunner {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/bao7uo/HexyRunner"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "67741b4d-7336-5c88-8f2c-e48c10b187b9"
    strings:
        $name = "HexyRunner" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_SharpOffensiveShell
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/darkr4y/SharpOffensiveShell

Pattern signatures:
$name = "SharpOffensiveShell" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_SharpOffensiveShell {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/darkr4y/SharpOffensiveShell"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "f223fb95-9f16-5504-a6ce-de9d75b38eaa"
    strings:
        $name = "SharpOffensiveShell" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_reconness
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/reconness/reconness

Pattern signatures:
$name = "reconness" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_reconness {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/reconness/reconness"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "a30188e4-d96a-59d0-9f51-d7a7e07b14ba"
    strings:
        $name = "reconness" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_tvasion
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/loadenmb/tvasion

Pattern signatures:
$name = "tvasion" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_tvasion {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/loadenmb/tvasion"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "324cddc6-36d9-5670-827e-24e80dcc66a9"
    strings:
        $name = "tvasion" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_ibombshell
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/Telefonica/ibombshell

Pattern signatures:
$name = "ibombshell" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_ibombshell {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/Telefonica/ibombshell"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "02f3272f-8e75-5df4-9052-a315ae202050"
    strings:
        $name = "ibombshell" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_RemoteProcessInjection
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/Mr-Un1k0d3r/RemoteProcessInjection

Pattern signatures:
$name = "RemoteProcessInjection" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_RemoteProcessInjection {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/Mr-Un1k0d3r/RemoteProcessInjection"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "f1698cf2-211a-551a-8bc4-4faefcc6106f"
    strings:
        $name = "RemoteProcessInjection" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_CACTUSTORCH
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/mdsecactivebreach/CACTUSTORCH

Pattern signatures:
$name = "CACTUSTORCH" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_CACTUSTORCH {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/mdsecactivebreach/CACTUSTORCH"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "7b1e3015-fada-592c-b120-20aa12247d32"
    strings:
        $name = "CACTUSTORCH" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_PandaSniper
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/QAX-A-Team/PandaSniper

Pattern signatures:
$name = "PandaSniper" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_PandaSniper {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/QAX-A-Team/PandaSniper"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "006400fb-7e6d-563b-ba78-17937983c9ba"
    strings:
        $name = "PandaSniper" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_xbapAppWhitelistBypassPOC
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/jpginc/xbapAppWhitelistBypassPOC

Pattern signatures:
$name = "xbapAppWhitelistBypassPOC" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_xbapAppWhitelistBypassPOC {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/jpginc/xbapAppWhitelistBypassPOC"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "b05253ce-cba4-531d-8f39-d8fae71b114d"
    strings:
        $name = "xbapAppWhitelistBypassPOC" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_StageStrike
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/RedXRanger/StageStrike

Pattern signatures:
$name = "StageStrike" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_StageStrike {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/RedXRanger/StageStrike"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "e3f9de04-87f6-5b07-b5b0-a26167937fcc"
    strings:
        $name = "StageStrike" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: EXT_HKTL_Nighthawk_RAT
Repository: Neo23x0/signature-base
Detects: Detects Nighthawk RAT
Author: Frank Boldewin (@r3c0nst)

Pattern signatures:
$pattern1 = { 48 8d 0d ?? ?? ?? ?? 51 5a 48 81 c1 ?? ?? ?? ?? 48 81 c2 ?? ?? ?? ?? ff e2 }
		$pattern2 = { 66 03 D2 66 33 D1 66 C1 E2 02 66 33 D1 66 23 D0 0F B7 C1 }
		$pattern3 = { FF 7F 48 3B F0 48 0F 47 F0 48 8D }
		$pattern4 = { 65 48 8B 04 25 30 00 00 00 8B 40 68 49 89 CA 0F 05 C3 }
		$pattern5 = { 48 B8 AA AA AA AA AA AA AA 02 48 ?? ?? ?? ?? 0F 84 }
		$pattern6 = { 65 48 8B 04 25 30 00 00 00 48 8B 80 }

Detection condition:
uint16(0) == 0x5A4D and filesize < 2MB and
		(3 of ($pattern*) or
		(pe.section_index(".profile") >= 0 and pe.section_index(".detourc") >= 0 and pe.section_index(".detourd") >= 0))

Full rule:
rule EXT_HKTL_Nighthawk_RAT
{
	meta:
		description = "Detects Nighthawk RAT"
		author = "Frank Boldewin (@r3c0nst)"
		references = "https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice"
		hash1 = "0551ca07f05c2a8278229c1dc651a2b1273a[PII_REDACTED]1b075733753cb2b988"
		hash2 = "9a57919cc5c194e28acd62719487c563a8f0ef1205b65adbe535386e34e418b8"
		hash3 = "38881b87826f184cc91559555a3456ecf00128e01986a9df36a72d60fb179ccf"
		hash4 = "f3bba2bfd4ed48b5426e36eba3b[PII_REDACTED]983a784d24d7a20fcf9df0de74e"
		hash5 = "b775a8f[PII_REDACTED]cc7727e2081924a7d7cf83edd7447aa60627a2b67d87c94"
		modified = "2025-07-01"
		date = "2022-11-22"

		id = "7a58b8bf-fb14-5758-bc2a-ad2c6fff1216"
	strings:
		$pattern1 = { 48 8d 0d ?? ?? ?? ?? 51 5a 48 81 c1 ?? ?? ?? ?? 48 81 c2 ?? ?? ?? ?? ff e2 }
		$pattern2 = { 66 03 D2 66 33 D1 66 C1 E2 02 66 33 D1 66 23 D0 0F B7 C1 }
		$pattern3 = { FF 7F 48 3B F0 48 0F 47 F0 48 8D }
		$pattern4 = { 65 48 8B 04 25 30 00 00 00 8B 40 68 49 89 CA 0F 05 C3 }
		$pattern5 = { 48 B8 AA AA AA AA AA AA AA 02 48 ?? ?? ?? ?? 0F 84 }
		$pattern6 = { 65 48 8B 04 25 30 00 00 00 48 8B 80 }

	condition:
		uint16(0) == 0x5A4D and filesize < 2MB and
		(3 of ($pattern*) or
		(pe.section_index(".profile") >= 0 and pe.section_index(".detourc") >= 0 and pe.section_index(".detourd") >= 0))
}
YARA Detection Rule: APT_Sandworm_Keywords_May20_1
Repository: Neo23x0/signature-base
Detects: Detects commands used by Sandworm group to exploit critical vulernability CVE-2019-10149 in Exim
Author: Florian Roth (Nextron Systems)
Reference: https://media.defense.gov/2020/May/28/[PII_REDACTED]/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%[PII_REDACTED].pdf

Pattern signatures:
$x1 = "MAIL FROM:<$(run("
      $x2 = "exec\\x20\\x2Fusr\\x2Fbin\\x2Fwget\\x20\\x2DO\\x20\\x2D\\x20http"

Detection condition:
filesize < 8000KB and
      1 of them

Full rule:
rule APT_Sandworm_Keywords_May20_1 {
   meta:
      description = "Detects commands used by Sandworm group to exploit critical vulernability CVE-2019-10149 in Exim"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://media.defense.gov/2020/May/28/[PII_REDACTED]/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%[PII_REDACTED].pdf"
      date = "2020-05-28"
      id = "e0d4e90e-5547-5487-8d0c-a141d88fff7c"
   strings:
      $x1 = "MAIL FROM:<$(run("
      $x2 = "exec\\x20\\x2Fusr\\x2Fbin\\x2Fwget\\x20\\x2DO\\x20\\x2D\\x20http"
   condition:
      filesize < 8000KB and
      1 of them
}
YARA Detection Rule: APT_Sandworm_SSH_Key_May20_1
Repository: Neo23x0/signature-base
Detects: Detects SSH key used by Sandworm on exploited machines
Author: Florian Roth (Nextron Systems)
Reference: https://media.defense.gov/2020/May/28/[PII_REDACTED]/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%[PII_REDACTED].pdf

Pattern signatures:
$x1 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2q/NGN/brzNfJiIp2zswtL33tr74pIAjMeWtXN1p5Hqp5fTp058U1EN4NmgmjX0KzNjjV"

Detection condition:
filesize < 1000KB and
      1 of them

Full rule:
rule APT_Sandworm_SSH_Key_May20_1 {
   meta:
      description = "Detects SSH key used by Sandworm on exploited machines"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://media.defense.gov/2020/May/28/[PII_REDACTED]/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%[PII_REDACTED].pdf"
      date = "2020-05-28"
      hash1 = "dc074464e[PII_REDACTED]8ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
      hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
      id = "ea2968b8-7ae4-56b8-9547-816c5e37c50a"
   strings:
      $x1 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2q/NGN/brzNfJiIp2zswtL33tr74pIAjMeWtXN1p5Hqp5fTp058U1EN4NmgmjX0KzNjjV"
   condition:
      filesize < 1000KB and
      1 of them
}
YARA Detection Rule: APT_Sandworm_SSHD_Config_Modification_May20_1
Repository: Neo23x0/signature-base
Detects: Detects ssh config entry inserted by Sandworm on compromised machines
Author: Florian Roth (Nextron Systems)
Reference: https://media.defense.gov/2020/May/28/[PII_REDACTED]/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%[PII_REDACTED].pdf

Pattern signatures:
$x1 = "AllowUsers mysql_db" ascii

      $a1 = "ListenAddress" ascii fullword

Detection condition:
filesize < 10KB and
      all of them

Full rule:
rule APT_Sandworm_SSHD_Config_Modification_May20_1 {
   meta:
      description = "Detects ssh config entry inserted by Sandworm on compromised machines"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://media.defense.gov/2020/May/28/[PII_REDACTED]/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%[PII_REDACTED].pdf"
      date = "2020-05-28"
      hash1 = "dc074464e[PII_REDACTED]8ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
      hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
      id = "dd60eeb7-3d4b-5a6a-8054-50c617ee8c73"
   strings:     
      $x1 = "AllowUsers mysql_db" ascii

      $a1 = "ListenAddress" ascii fullword
   condition:
      filesize < 10KB and
      all of them
}
YARA Detection Rule: APT_Sandworm_InitFile_May20_1
Repository: Neo23x0/signature-base
Detects: Detects mysql init script used by Sandworm on compromised machines
Author: Florian Roth (Nextron Systems)
Reference: https://media.defense.gov/2020/May/28/[PII_REDACTED]/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%[PII_REDACTED].pdf

Pattern signatures:
$s1 = "GRANT ALL PRIVILEGES ON * . * TO 'mysqldb'@'localhost';" ascii
      $s2 = "CREATE USER 'mysqldb'@'localhost' IDENTIFIED BY '" ascii fullword

Detection condition:
filesize < 10KB and
      all of them

Full rule:
rule APT_Sandworm_InitFile_May20_1 {
   meta:
      description = "Detects mysql init script used by Sandworm on compromised machines"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://media.defense.gov/2020/May/28/[PII_REDACTED]/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%[PII_REDACTED].pdf"
      date = "2020-05-28"
      hash1 = "dc074464e[PII_REDACTED]8ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
      hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
      id = "0bd613e3-6bd4-5cec-bc0d-2bdb83caf142"
   strings:     
      $s1 = "GRANT ALL PRIVILEGES ON * . * TO 'mysqldb'@'localhost';" ascii
      $s2 = "CREATE USER 'mysqldb'@'localhost' IDENTIFIED BY '" ascii fullword
   condition:
      filesize < 10KB and
      all of them
}