deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: SUSP_APT_3CX_Regtrans_Anomaly_Apr23
Repository: Neo23x0/signature-base
Detects: Detects suspicious .regtrans-ms files with suspicious size or contents
Author: Florian Roth
Reference: https://www.3cx.com/blog/news/mandiant-initial-results/

Pattern signatures:
$fp1 = "REGISTRY" wide

Detection condition:
extension == ".regtrans-ms" and (
         filesize < 100KB
         and not 1 of ($fp*)
      )

Full rule:
rule SUSP_APT_3CX_Regtrans_Anomaly_Apr23 : METARULE {
   meta:
      description = "Detects suspicious .regtrans-ms files with suspicious size or contents"
      author = "Florian Roth"
      reference = "https://www.3cx.com/blog/news/mandiant-initial-results/"
      date = "2023-04-12"
      score = 60
      id = "97406b8d-68fe-5f68-a26a-205dd4694e50"
   strings:
      $fp1 = "REGISTRY" wide
   condition:
      extension == ".regtrans-ms" and (
         filesize < 100KB
         and not 1 of ($fp*)
      )
}
YARA Detection Rule: APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_2
Repository: Neo23x0/signature-base
Detects: Detects malicious VEILEDSIGNAL backdoor
Author: X__Junior
Reference: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain

Pattern signatures:
$sa1 = "\\.\\pipe\\gecko.nativeMessaging" ascii
      $sa2 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Edg/95.0.1020.40" ascii
      $sa3 = "application/json, text/javascript, */*; q=0.01" ascii

      $op1 = { 89 7? 24 ?? 44 8B CD 4C 8B C? 48 89 44 24 ?? 33 D2 33 C9 FF 15} /* MultiByteToWideChar */
      $op2 = { 4C 8B CB 4C 89 74 24 ?? 4C 8D 05 ?? ?? ?? ?? 44 89 74 24 ?? 33 D2 33 C9 FF 15} /* create thread*/
      $op3 = { 48 89 74 24 ?? 45 33 C0 89 74 24 ?? 41 B9 ?? ?? ?? ?? 89 74 24 ?? 48 8B D8 48 C7 00 ?? ?? ?? ?? 48 8B 0F 41 8D 50 ?? 48 89 44 24 ?? 89 74 24 ?? FF 15} /* CreateNamedPipeW */

Detection condition:
all of ($op*) or all of ($sa*)

Full rule:
rule APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_2 {
   meta:
      description = "Detects malicious VEILEDSIGNAL backdoor"
      author = "X__Junior"
      reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain"
      date = "2023-04-29"
      hash = "c4887a5cd6d98e273ba6e9ea3c1d8f770ef26239819ea24a1bfebd81d6870505"
      score = 80
      id = "ff1fa0bd-19b7-553a-9506-bc5aa5d29056"
   strings:
      $sa1 = "\\.\\pipe\\gecko.nativeMessaging" ascii
      $sa2 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Edg/95.0.1020.40" ascii
      $sa3 = "application/json, text/javascript, */*; q=0.01" ascii

      $op1 = { 89 7? 24 ?? 44 8B CD 4C 8B C? 48 89 44 24 ?? 33 D2 33 C9 FF 15} /* MultiByteToWideChar */
      $op2 = { 4C 8B CB 4C 89 74 24 ?? 4C 8D 05 ?? ?? ?? ?? 44 89 74 24 ?? 33 D2 33 C9 FF 15} /* create thread*/
      $op3 = { 48 89 74 24 ?? 45 33 C0 89 74 24 ?? 41 B9 ?? ?? ?? ?? 89 74 24 ?? 48 8B D8 48 C7 00 ?? ?? ?? ?? 48 8B 0F 41 8D 50 ?? 48 89 44 24 ?? 89 74 24 ?? FF 15} /* CreateNamedPipeW */
   condition:
      all of ($op*) or all of ($sa*)
}
YARA Detection Rule: APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_3
Repository: Neo23x0/signature-base
Detects: Detects malicious VEILEDSIGNAL backdoor
Author: X__Junior
Reference: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain

Pattern signatures:
$op1 = { 4C 8B CB 4C 89 74 24 ?? 4C 8D 05 ?? ?? ?? ?? 44 89 74 24 ?? 33 D2 33 C9 FF 15} /* create thread*/
      $op2 = { 89 7? 24 ?? 44 8B CD 4C 8B C? 48 89 44 24 ?? 33 D2 33 C9 FF 15} /* MultiByteToWideChar */
      $op3 = { 8B 54 24 ?? 4C 8D 4C 24 ?? 45 8D 46 ?? 44 89 74 24 ?? 48 8B CB FF 15} /* virtualprotect */
      $op4 = { 48 8D 44 24 ?? 45 33 C9 41 B8 01 00 00 40 48 89 44 24 ?? 41 8B D5 48 8B CF FF 15} /*  CryptBinaryToStringA */

Detection condition:
all of them

Full rule:
rule APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_3 {
   meta:
      description = "Detects malicious VEILEDSIGNAL backdoor"
      author = "X__Junior"
      reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain"
      date = "2023-04-29"
      hash = "595392959b609caf088d027a23443cf2fefd043607ccdec3de19ad3bb43a74b1"
      score = 80
      id = "6b6f984e-242a-5b84-baa9-6311992cde9b"
   strings:
      $op1 = { 4C 8B CB 4C 89 74 24 ?? 4C 8D 05 ?? ?? ?? ?? 44 89 74 24 ?? 33 D2 33 C9 FF 15} /* create thread*/
      $op2 = { 89 7? 24 ?? 44 8B CD 4C 8B C? 48 89 44 24 ?? 33 D2 33 C9 FF 15} /* MultiByteToWideChar */
      $op3 = { 8B 54 24 ?? 4C 8D 4C 24 ?? 45 8D 46 ?? 44 89 74 24 ?? 48 8B CB FF 15} /* virtualprotect */
      $op4 = { 48 8D 44 24 ?? 45 33 C9 41 B8 01 00 00 40 48 89 44 24 ?? 41 8B D5 48 8B CF FF 15} /*  CryptBinaryToStringA */
   condition:
      all of them
}
YARA Detection Rule: APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_4
Repository: Neo23x0/signature-base
Detects: Detects malicious VEILEDSIGNAL backdoor
Author: X__Junior
Reference: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain

Pattern signatures:
$op1 = { 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 } /* check for certian process */
		$op2 = { 48 8B C8 48 8D 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 45 33 C0 4C 8D 4D ?? B2 01 41 8D 48 ?? FF D0} /* RtlAdjustPrivilege */
      $op3 = { 33 FF C7 44 24 ?? 38 02 00 00 33 D2 8D 4F ?? FF 15 ?? ?? ?? ?? 48 8B D8 48 83 F8 FF 74 ?? 48 8D 54 24 ?? 48 8B C8 FF 15 } /* Process32FirstW */
      $op4 = { 4C 8D 05 ?? ?? ?? ?? 48 89 4C 24 ?? 4C 8B C8 33 D2 89 4C 24 ?? FF 15 } /* create thread*/

Detection condition:
all of them

Full rule:
rule APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_4 {
   meta:
      description = "Detects malicious VEILEDSIGNAL backdoor"
      author = "X__Junior"
      reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain"
      date = "2023-04-29"
      hash = "9b0761f81afb102bb784b398b16faa965594e469a7fcfdfd553ced19cc17e70b"
      score = 80
      id = "77340ec0-36bb-5c47-995f-4e6f76b68fe1"
   strings:
      $op1 = { 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 } /* check for certian process */
		$op2 = { 48 8B C8 48 8D 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 45 33 C0 4C 8D 4D ?? B2 01 41 8D 48 ?? FF D0} /* RtlAdjustPrivilege */
      $op3 = { 33 FF C7 44 24 ?? 38 02 00 00 33 D2 8D 4F ?? FF 15 ?? ?? ?? ?? 48 8B D8 48 83 F8 FF 74 ?? 48 8D 54 24 ?? 48 8B C8 FF 15 } /* Process32FirstW */
      $op4 = { 4C 8D 05 ?? ?? ?? ?? 48 89 4C 24 ?? 4C 8B C8 33 D2 89 4C 24 ?? FF 15 } /* create thread*/
   condition:
      all of them
}
YARA Detection Rule: VULN_Confluence_Questions_Plugin_CVE_2022_26138_Jul22_1
Repository: Neo23x0/signature-base
Detects: Detects properties file of Confluence Questions plugin with static user name and password (backdoor) CVE-2022-26138
Author: Florian Roth (Nextron Systems)
Reference: https://www.bleepingcomputer.com/news/security/atlassian-fixes-critical-confluence-hardcoded-credentials-flaw/

Pattern signatures:
$x_plain_1 = "predefined.user.[CREDENTIAL_REDACTED]"

      $jar_marker = "/confluence/plugins/questions/"
      /*                 v this is the size of 204 bytes              */
      $jar_size_1 = { 00 CC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
      /*    here starts default.properties v                          */
                      ?? ?? ?? ?? ?? ?? 00 64 65 66 61 75 6C 74 2E 70
                      72 6F 70 65 72 74 69 65 73 50 4B }
      $jar_size_2 = { 00 CC 00 ?? ?? ?? ?? ?? 00 64 65 66 61 75 6C 74
                      2E 70 72 6F 70 65 72 74 69 65 73 }

Detection condition:
1 of ($x*) or ( $jar_marker and 1 of ($jar_size*) )

Full rule:
rule VULN_Confluence_Questions_Plugin_CVE_2022_26138_Jul22_1 {
   meta:
      description = "Detects properties file of Confluence Questions plugin with static user name and password (backdoor) CVE-2022-26138"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.bleepingcomputer.com/news/security/atlassian-fixes-critical-confluence-hardcoded-credentials-flaw/"
      date = "2022-07-21"
      score = 50
      id = "1443c673-2a86-5431-876a-c8fccba52190"
   strings:
      $x_plain_1 = "predefined.user.[CREDENTIAL_REDACTED]"

      $jar_marker = "/confluence/plugins/questions/"
      /*                 v this is the size of 204 bytes              */
      $jar_size_1 = { 00 CC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
      /*    here starts default.properties v                          */
                      ?? ?? ?? ?? ?? ?? 00 64 65 66 61 75 6C 74 2E 70
                      72 6F 70 65 72 74 69 65 73 50 4B }
      $jar_size_2 = { 00 CC 00 ?? ?? ?? ?? ?? 00 64 65 66 61 75 6C 74
                      2E 70 72 6F 70 65 72 74 69 65 73 }
   condition:
      1 of ($x*) or ( $jar_marker and 1 of ($jar_size*) )
}
YARA Detection Rule: URL_File_Local_EXE
Repository: Neo23x0/signature-base
Detects: Detects an .url file that points to a local executable
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/malwareforme/status/[PII_REDACTED]12870144

Pattern signatures:
$s1 = "[InternetShortcut]" ascii wide fullword
      $s2 = /URL=file:\/\/\/C:\\[^\n]{1,50}\.exe/

Detection condition:
filesize < 400 and all of them

Full rule:
rule URL_File_Local_EXE {
   meta:
      description = "Detects an .url file that points to a local executable"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/malwareforme/status/[PII_REDACTED]12870144"
      date = "2017-10-04"
      score = 60
      id = "8b157e98-7b69-5649-b1d8-40bd6b685bf6"
   strings:
      $s1 = "[InternetShortcut]" ascii wide fullword
      $s2 = /URL=file:\/\/\/C:\\[^\n]{1,50}\.exe/
   condition:
      filesize < 400 and all of them
}
YARA Detection Rule: EXPL_ManageEngine_CVE_2022_47966_Jan23_1
Repository: Neo23x0/signature-base
Detects: Detects indicators of exploitation of ManageEngine vulnerability as described by Horizon3
Author: Florian Roth (Nextron Systems)
Reference: https://www.horizon3.ai/manageengine-cve-2022-47966-iocs/

Pattern signatures:
$ = "]: com.adventnet.authentication.saml.SamlException: Signature validation failed. SAML Response rejected|"

Detection condition:
1 of them

Full rule:
rule EXPL_ManageEngine_CVE_2022_47966_Jan23_1 {
   meta:
      description = "Detects indicators of exploitation of ManageEngine vulnerability as described by Horizon3"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.horizon3.ai/manageengine-cve-2022-47966-iocs/"
      date = "2023-01-13"
      score = 75
      id = "07535b9c-8611-5a46-bcd7-f94070de2aea"
   strings:
      $ = "]: com.adventnet.authentication.saml.SamlException: Signature validation failed. SAML Response rejected|"
   condition:
      1 of them
}
YARA Detection Rule: EXPL_HKTL_LNX_DirtyFragLPE_May26
Repository: Neo23x0/signature-base
Detects: Detects dirtyfrag, a local privilege escalation exploit for Linux.
Author: Pezier Pierre-Henri (Nextron Systems)
Reference: https://github.com/V4bel/dirtyfrag/tree/master

Pattern signatures:
// Indicators of exploitation attempts
      $x1 = "gained CAP_NET_RAW within netn" ascii
      $x2 = "DIRTYFRAG_VERBOSE" ascii

      $s1 = { 15 7C 4A 7F B9 79 37 9E }  // fc_splitmix64
      $s2 = "/proc/self/setgroups" ascii fullword
      $s3 = "pcbc(fcrypt)" ascii fullword
      $s4 = { 17 bb c7 f3 3f 36 ba 71 8e 97 65 60 69 b6 f6 e6 }

Detection condition:
filesize < 100KB
      and uint32be(0) == 0x7f454c46
      and (
         1 of ($x*)
         or 3 of ($s*)
      )

Full rule:
rule EXPL_HKTL_LNX_DirtyFragLPE_May26 {
   meta:
      description = "Detects dirtyfrag, a local privilege escalation exploit for Linux."
      author = "Pezier Pierre-Henri (Nextron Systems)"
      date = "2026-05-07"
      score = 80
      hash = "c35594d42f7a5d5d[PII_REDACTED]ee1bc62bb8e294c8468093b7d6fcaab0b174c8"
      reference = "https://github.com/V4bel/dirtyfrag/tree/master"
   strings:
      // Indicators of exploitation attempts
      $x1 = "gained CAP_NET_RAW within netn" ascii
      $x2 = "DIRTYFRAG_VERBOSE" ascii

      $s1 = { 15 7C 4A 7F B9 79 37 9E }  // fc_splitmix64
      $s2 = "/proc/self/setgroups" ascii fullword
      $s3 = "pcbc(fcrypt)" ascii fullword
      $s4 = { 17 bb c7 f3 3f 36 ba 71 8e 97 65 60 69 b6 f6 e6 }
   condition:
      filesize < 100KB
      and uint32be(0) == 0x7f454c46
      and (
         1 of ($x*)
         or 3 of ($s*)
      )
}
YARA Detection Rule: EXPL_HKTL_LNX_DirtyFragShellcode_May26
Repository: Neo23x0/signature-base
Detects: Detects a shellcode observed in dirtyfrag, a local privilege escalation exploit for Linux.
Author: Pezier Pierre-Henri (Nextron Systems)
Reference: https://github.com/V4bel/dirtyfrag/tree/master

Pattern signatures:
$op1 = {
         31 ff     // xor     edi, edi
         31 f6     // xor     esi, esi
         31 c0     // xor     eax, eax
         b0 6a     // mov     al, 6Ah ; 'j'
         0f 05     // syscall; LINUX - sys_setgid
         b0 69     // mov     al, 69h ; 'i'
         0f 05     // syscall; LINUX - sys_setuid
         b0 74     // mov     al, 74h ; 't'
         0f 05     // syscall; LINUX - sys_setgroups
         6a 00     // push    0
         48 [6]    // lea     rax, aTermXterm; "TERM=xterm"
         50        // push    rax
         48 89 e2  // mov     rdx, rsp
         48 [6]    // lea     rdi, aBinSh; "/bin/sh"
         31 f6     // xor     esi, esi
         6a 3b     // push    3Bh ; ';'
         58        // pop     rax
         0f 05     // syscall; LINUX - sys_execve
      }

Detection condition:
$op1

Full rule:
rule EXPL_HKTL_LNX_DirtyFragShellcode_May26 {
   meta:
      description = "Detects a shellcode observed in dirtyfrag, a local privilege escalation exploit for Linux."
      reference = "https://github.com/V4bel/dirtyfrag/tree/master"
      author = "Pezier Pierre-Henri (Nextron Systems)"
      date = "2026-05-07"
      score = 80
      hash = "a02ea2ba8108a9b7a997faa8808cfc55bb69af54e69178fa5aa1785681cf0ced"
   strings:
      $op1 = {
         31 ff     // xor     edi, edi
         31 f6     // xor     esi, esi
         31 c0     // xor     eax, eax
         b0 6a     // mov     al, 6Ah ; 'j'
         0f 05     // syscall; LINUX - sys_setgid
         b0 69     // mov     al, 69h ; 'i'
         0f 05     // syscall; LINUX - sys_setuid
         b0 74     // mov     al, 74h ; 't'
         0f 05     // syscall; LINUX - sys_setgroups
         6a 00     // push    0
         48 [6]    // lea     rax, aTermXterm; "TERM=xterm"
         50        // push    rax
         48 89 e2  // mov     rdx, rsp
         48 [6]    // lea     rdi, aBinSh; "/bin/sh"
         31 f6     // xor     esi, esi
         6a 3b     // push    3Bh ; ';'
         58        // pop     rax
         0f 05     // syscall; LINUX - sys_execve
      }
   condition:
      $op1
}
YARA Detection Rule: EXPL_LNX_DirtyFrag_ForensicArtefacts_May26
Repository: Neo23x0/signature-base
Detects: Detects DirtyFrag exploit code POC usage in Linux environments
Author: Florian Roth
Reference: https://github.com/V4bel/dirtyfrag/tree/master

Pattern signatures:
$xa1 = "/V4bel/dirtyfrag.git" ascii
      $xa2 = "static const uint8_t shell_elf[PAYLOAD_LEN] = {" ascii
      $xa3 = "/usr/bin/su page-cache patched (entry 0x%x = shellcode)" ascii

Detection condition:
filesize < 800KB
      and 1 of ($xa*)

Full rule:
rule EXPL_LNX_DirtyFrag_ForensicArtefacts_May26 {
   meta:
      description = "Detects DirtyFrag exploit code POC usage in Linux environments"
      author = "Florian Roth"
      reference = "https://github.com/V4bel/dirtyfrag/tree/master"
      date = "2026-05-08"
      score = 75
   strings:
      $xa1 = "/V4bel/dirtyfrag.git" ascii
      $xa2 = "static const uint8_t shell_elf[PAYLOAD_LEN] = {" ascii
      $xa3 = "/usr/bin/su page-cache patched (entry 0x%x = shellcode)" ascii
   condition:
      filesize < 800KB
      and 1 of ($xa*)
}
YARA Detection Rule: SUSP_certificate_payload
Repository: Neo23x0/signature-base
Detects: Detects payloads that pretend to be certificates
Author: Didier Stevens, Florian Roth
Reference: https://blog.nviso.be/2018/08/02/powershell-inside-a-certificate-part-3/

Pattern signatures:
$re1 = "-----BEGIN CERTIFICATE-----"

      $fp1 = "replace it with the PEM-encoded root certificate"

Detection condition:
uint32(0) == 0x2D2D2D2D
      and $re1 at 0
      /* not 'M' at position 29, which is after the BEGIN CERTIFICATE header plus line break */
      /* \r\n */
      and not uint8(29) == 0x4D
      /* \n */
      and not uint8(28) == 0x4D
      and not 1 of ($fp*)

Full rule:
rule SUSP_certificate_payload {
   meta:
      description = "Detects payloads that pretend to be certificates"
      date = "2018/08/02"
      author = "Didier Stevens, Florian Roth"
      reference = "https://blog.nviso.be/2018/08/02/powershell-inside-a-certificate-part-3/"
      score = 50
      id = "6f1fe410-591a-5a59-a683-67cad9777dfe"
   strings:
      $re1 = "-----BEGIN CERTIFICATE-----"

      $fp1 = "replace it with the PEM-encoded root certificate"
   condition:
      uint32(0) == 0x2D2D2D2D
      and $re1 at 0
      /* not 'M' at position 29, which is after the BEGIN CERTIFICATE header plus line break */
      /* \r\n */
      and not uint8(29) == 0x4D
      /* \n */
      and not uint8(28) == 0x4D
      and not 1 of ($fp*)
}
YARA Detection Rule: TeleDoor_Backdoor
Repository: Neo23x0/signature-base
Detects: Detects the TeleDoor Backdoor as used in Petya Attack in June 2017
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/CpfJQQ

Pattern signatures:
/* Payload\x00AutoPayload */
      $c1 = { 50 61 79 6C 6F 61 64 00 41 75 74 6F 50 61 79 6C 6F 61 64 }
      /* RunCmd\x00DumpData */
      $c2 = { 52 75 6E 43 6D 64 00 44 75 6D 70 44 61 74 61 }
      /* ZvitWebClientExt\x00MinInfo */
      $c3 = { 00 5A 76 69 74 57 65 62 43 6C 69 65 6E 74 45 78 74 00 4D 69 6E 49 6E 66 6F }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 15000KB and 2 of them )

Full rule:
rule TeleDoor_Backdoor {
   meta:
      description = "Detects the TeleDoor Backdoor as used in Petya Attack in June 2017"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/CpfJQQ"
      date = "2017-07-05"
      hash1 = "d[PII_REDACTED]50416d6addd3bfdf48590f8440dd80fc571a389023b7c860ca3ac"
      hash2 = "f9d6fe8bd8aca6528dec7eaa9f1aafbecde15fd61668182f2ba8a7fc2b9a6740"
      hash3 = "2fd2863d711a1f18eeee5c7c82f2349c5d4e00465de9789da837fcdca4d00277"
      id = "ba9b4415-427e-5a13-b743-bed225d86db8"
   strings:
      /* Payload\x00AutoPayload */
      $c1 = { 50 61 79 6C 6F 61 64 00 41 75 74 6F 50 61 79 6C 6F 61 64 }
      /* RunCmd\x00DumpData */
      $c2 = { 52 75 6E 43 6D 64 00 44 75 6D 70 44 61 74 61 }
      /* ZvitWebClientExt\x00MinInfo */
      $c3 = { 00 5A 76 69 74 57 65 62 43 6C 69 65 6E 74 45 78 74 00 4D 69 6E 49 6E 66 6F }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 15000KB and 2 of them )
}
YARA Detection Rule: APT_GreyEnergy_Malware_Oct18_1
Repository: Neo23x0/signature-base
Detects: Detects samples from Grey Energy report
Author: Florian Roth (Nextron Systems)
Reference: https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/

Pattern signatures:
$x1 = "%SystemRoot%\\System32\\thinmon.dll" fullword ascii
      $s2 = "'Cannot delete list entry (fatal error)!9The module %s cannot be executed on this system (0x%.4x).%Enumerate all sessions on TSE" wide
      $s8 = "cbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbe" ascii
      $s14 = "configure the service" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 700KB and
      pe.imphash() == "98d1ad672d0db4b4abdcda73cc9835cb" and
      all of them

Full rule:
rule APT_GreyEnergy_Malware_Oct18_1 {
   meta:
      description = "Detects samples from Grey Energy report"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
      date = "2018-10-17"
      hash1 = "6c52a5850a57bea43a0a52ff0e2d2179653b97ae5406e884aee63e1cf340f58b"
      id = "fc997540-075e-5f1c-9238-135c1572553b"
   strings:
      $x1 = "%SystemRoot%\\System32\\thinmon.dll" fullword ascii
      $s2 = "'Cannot delete list entry (fatal error)!9The module %s cannot be executed on this system (0x%.4x).%Enumerate all sessions on TSE" wide
      $s8 = "cbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbe" ascii
      $s14 = "configure the service" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 700KB and
      pe.imphash() == "98d1ad672d0db4b4abdcda73cc9835cb" and
      all of them
}
YARA Detection Rule: APT_GreyEnergy_Malware_Oct18_2
Repository: Neo23x0/signature-base
Detects: Detects samples from Grey Energy report
Author: Florian Roth (Nextron Systems)
Reference: https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/

Pattern signatures:
$s1 = "WioGLtonuaptWmrnttfepgetneemVsnygnV" fullword ascii
      $s2 = "PnSenariopoeKerGEtxrcy" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and 2 of them

Full rule:
rule APT_GreyEnergy_Malware_Oct18_2 {
   meta:
      description = "Detects samples from Grey Energy report"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
      date = "2018-10-17"
      hash1 = "c6a54912f77a39c8f909a66a940350dcd8474c7a1d0e215a878349f1b038c58a"
      id = "50830741-ba3d-505c-bb21-8cedc2162f96"
   strings:
      $s1 = "WioGLtonuaptWmrnttfepgetneemVsnygnV" fullword ascii
      $s2 = "PnSenariopoeKerGEtxrcy" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 300KB and 2 of them
}
YARA Detection Rule: APT_GreyEnergy_Malware_Oct18_3
Repository: Neo23x0/signature-base
Detects: Detects samples from Grey Energy report
Author: Florian Roth (Nextron Systems)
Reference: https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/

Pattern signatures:
$x1 = "USQTUNPPQONOPOQUMSNUTRMRRLVPUOPMROPMPMQTPNPONVUOUQOMMNNSRSRQQVTPPRSSNVSTURTMMOPTONSQTOMONQVMQNUSONTQTUTSRRPVTONUQNORQMRRNRUSPS" fullword ascii
      $x2 = "tEMPiuP" fullword ascii
      $x3 = "sryCEMieye" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and 1 of them

Full rule:
rule APT_GreyEnergy_Malware_Oct18_3 {
   meta:
      description = "Detects samples from Grey Energy report"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
      date = "2018-10-17"
      hash1 = "0db5e5b68dc4b8089197de9c1e345056f45c006b7b487f7d8d57b49ae385bad0"
      id = "cc365dbf-1448-5219-95f5-d1154000f52d"
   strings:
      $x1 = "USQTUNPPQONOPOQUMSNUTRMRRLVPUOPMROPMPMQTPNPONVUOUQOMMNNSRSRQQVTPPRSSNVSTURTMMOPTONSQTOMONQVMQNUSONTQTUTSRRPVTONUQNORQMRRNRUSPS" fullword ascii
      $x2 = "tEMPiuP" fullword ascii
      $x3 = "sryCEMieye" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 300KB and 1 of them
}