deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: header_evasion
Repository: Yara-Rules/rules
Detects: 3.4.1, 'File Header' of Appendix H states that ' Acrobat viewers require only that the header appear somewhere within the first 1024 bytes of the file.'  Therefore, if you see this trigger then any other rule looking to match the magic at 0 won't be applicable
Author: Glenn Edwards (@hiddenillusion)

Pattern signatures:
$magic = { 25 50 44 46 }

Detection condition:
$magic in (5..1024) and #magic == 1

Full rule:
rule header_evasion : PDF raw
{
        meta:
                author = "Glenn Edwards (@hiddenillusion)"
                description = "3.4.1, 'File Header' of Appendix H states that ' Acrobat viewers require only that the header appear somewhere within the first 1024 bytes of the file.'  Therefore, if you see this trigger then any other rule looking to match the magic at 0 won't be applicable"
                ref = "http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/devnet/pdf/pdfs/pdf_reference_1-7.pdf"
                version = "0.1"
                weight = 3

        strings:
                $magic = { 25 50 44 46 }
        condition:
                $magic in (5..1024) and #magic == 1
}
YARA Detection Rule: BlackHole_v2
Repository: Yara-Rules/rules
Author: Glenn Edwards (@hiddenillusion)

Pattern signatures:
$magic = { 25 50 44 46 }
		$content = "Index[5 1 7 1 9 4 23 4 50"

Detection condition:
$magic in (0..1024) and $content

Full rule:
rule BlackHole_v2 : PDF raw
{
	meta:
		author = "Glenn Edwards (@hiddenillusion)"
		version = "0.1"
		ref = "http://fortknoxnetworks.blogspot.no/2012/10/blackhhole-exploit-kit-v-20-url-pattern.html"
		weight = 3
		
	strings:
		$magic = { 25 50 44 46 }
		$content = "Index[5 1 7 1 9 4 23 4 50"
		
	condition:
		$magic in (0..1024) and $content
}
YARA Detection Rule: XDP_embedded_PDF
Repository: Yara-Rules/rules
Author: Glenn Edwards (@hiddenillusion)

Pattern signatures:
$s1 = "<pdf xmlns="
		$s2 = "<chunk>"
		$s3 = "</pdf>"
		$header0 = "%PDF"
		$header1 = "JVBERi0"

Detection condition:
all of ($s*) and 1 of ($header*)

Full rule:
rule XDP_embedded_PDF : PDF raw
{
	meta:
		author = "Glenn Edwards (@hiddenillusion)"
		version = "0.1"
		ref = "http://blog.9bplus.com/av-bypass-for-malicious-pdfs-using-xdp"
        weight = 1		

	strings:
		$s1 = "<pdf xmlns="
		$s2 = "<chunk>"
		$s3 = "</pdf>"
		$header0 = "%PDF"
		$header1 = "JVBERi0"

	condition:
		all of ($s*) and 1 of ($header*)
}
YARA Detection Rule: PDF_Embedded_Exe
Repository: Yara-Rules/rules

Pattern signatures:
$header = {25 50 44 46}
    	$Launch_Action = {3C 3C 2F 53 2F 4C 61 75 6E 63 68 2F 54 79 70 65 2F 41 63 74 69 6F 6E 2F 57 69 6E 3C 3C 2F 46}
        $exe = {3C 3C 2F 45 6D 62 65 64 64 65 64 46 69 6C 65 73}

Detection condition:
$header at 0 and $Launch_Action and $exe

Full rule:
rule PDF_Embedded_Exe : PDF
{
	meta:
		ref = "https://github.com/jacobsoo/Yara-Rules/blob/master/PDF_Embedded_Exe.yar"
	strings:
    	$header = {25 50 44 46}
    	$Launch_Action = {3C 3C 2F 53 2F 4C 61 75 6E 63 68 2F 54 79 70 65 2F 41 63 74 69 6F 6E 2F 57 69 6E 3C 3C 2F 46}
        $exe = {3C 3C 2F 45 6D 62 65 64 64 65 64 46 69 6C 65 73}
    condition:
    	$header at 0 and $Launch_Action and $exe
}
YARA Detection Rule: RTFFILE
Repository: Yara-Rules/rules
Detects: Detects RTF files

Detection condition:
uint32be(0) == 0x7B5C7274

Full rule:
private rule RTFFILE {
   meta:
      description = "Detects RTF files"
   condition:
      uint32be(0) == 0x7B5C7274
}
YARA Detection Rule: CVE_2017_8759_Mal_HTA
Repository: Yara-Rules/rules
Detects: Detects malicious files related to CVE-2017-8759 - file cmd.hta
Author: Florian Roth
Reference: https://github.com/Voulnet/CVE-2017-8759-Exploit-sample

Pattern signatures:
$x1 = "Error = Process.Create(\"powershell -nop cmd.exe /c" fullword ascii

Detection condition:
( uint16(0) == 0x683c and filesize < 1KB and all of them )

Full rule:
rule CVE_2017_8759_Mal_HTA {
   meta:
      description = "Detects malicious files related to CVE-2017-8759 - file cmd.hta"
      author = "Florian Roth"
      reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
      date = "2017-09-14"
      hash1 = "fee2ab286eb542c08fdfef29fabf7796a0a91083a0ee29ebae[PII_REDACTED]94b5"
   strings:
      $x1 = "Error = Process.Create(\"powershell -nop cmd.exe /c" fullword ascii
   condition:
      ( uint16(0) == 0x683c and filesize < 1KB and all of them )
}
YARA Detection Rule: CVE_2017_8759_Mal_Doc
Repository: Yara-Rules/rules
Detects: Detects malicious files related to CVE-2017-8759 - file Doc1.doc
Author: Florian Roth
Reference: https://github.com/Voulnet/CVE-2017-8759-Exploit-sample

Pattern signatures:
$s1 = "soap:wsdl=http://" ascii wide nocase
      $s2 = "soap:wsdl=https://" ascii wide nocase

      $c1 = "Project.ThisDocument.AutoOpen" fullword wide

Detection condition:
( uint16(0) == 0xcfd0 and filesize < 500KB and 2 of them )

Full rule:
rule CVE_2017_8759_Mal_Doc {
   meta:
      description = "Detects malicious files related to CVE-2017-8759 - file Doc1.doc"
      author = "Florian Roth"
      reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
      date = "2017-09-14"
      hash1 = "6314c5696af4c4b24c3a92b0e92a064aaf04fd56673e830f4d339b8805cc9635"
   strings:
      $s1 = "soap:wsdl=http://" ascii wide nocase
      $s2 = "soap:wsdl=https://" ascii wide nocase

      $c1 = "Project.ThisDocument.AutoOpen" fullword wide
   condition:
      ( uint16(0) == 0xcfd0 and filesize < 500KB and 2 of them )
}
YARA Detection Rule: CVE_2017_8759_SOAP_via_JS
Repository: Yara-Rules/rules
Detects: Detects SOAP WDSL Download via JavaScript
Author: Florian Roth
Reference: https://twitter.com/buffaloverflow/status/[PII_REDACTED]78087680

Pattern signatures:
$s1 = "GetObject(\"soap:wsdl=https://" ascii wide nocase
      $s2 = "GetObject(\"soap:wsdl=http://" ascii wide nocase

Detection condition:
( filesize < 3KB and 1 of them )

Full rule:
rule CVE_2017_8759_SOAP_via_JS {
   meta:
      description = "Detects SOAP WDSL Download via JavaScript"
      author = "Florian Roth"
      reference = "https://twitter.com/buffaloverflow/status/[PII_REDACTED]78087680"
      date = "2017-09-14"
      score = 60
   strings:
      $s1 = "GetObject(\"soap:wsdl=https://" ascii wide nocase
      $s2 = "GetObject(\"soap:wsdl=http://" ascii wide nocase
   condition:
      ( filesize < 3KB and 1 of them )
}
YARA Detection Rule: CVE_2017_8759_SOAP_Excel
Repository: Yara-Rules/rules
Detects: Detects malicious files related to CVE-2017-8759
Author: Florian Roth
Reference: https://twitter.com/buffaloverflow/status/[PII_REDACTED]45869825

Pattern signatures:
$s1 = "|'soap:wsdl=" ascii wide nocase

Detection condition:
( filesize < 300KB and 1 of them )

Full rule:
rule CVE_2017_8759_SOAP_Excel {
   meta:
      description = "Detects malicious files related to CVE-2017-8759"
      author = "Florian Roth"
      reference = "https://twitter.com/buffaloverflow/status/[PII_REDACTED]45869825"
      date = "2017-09-15"
   strings:
      $s1 = "|'soap:wsdl=" ascii wide nocase
   condition:
      ( filesize < 300KB and 1 of them )
}
YARA Detection Rule: CVE_2017_8759_SOAP_txt
Repository: Yara-Rules/rules
Detects: Detects malicious file in releation with CVE-2017-8759 - file exploit.txt
Author: Florian Roth
Reference: https://github.com/Voulnet/CVE-2017-8759-Exploit-sample

Pattern signatures:
$s1 = /<soap:address location="http[s]?:\/\/[^"]{8,140}.hta"/ ascii wide
      $s2 = /<soap:address location="http[s]?:\/\/[^"]{8,140}mshta.exe"/ ascii wide

Detection condition:
( filesize < 200KB and 1 of them )

Full rule:
rule CVE_2017_8759_SOAP_txt {
   meta:
      description = "Detects malicious file in releation with CVE-2017-8759 - file exploit.txt"
      author = "Florian Roth"
      reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
      date = "2017-09-14"
      hash1 = "840ad14e29144be06722aff4cc04b377364eeed0a82b49cc[PII_REDACTED]8e2444"
   strings:
      $s1 = /<soap:address location="http[s]?:\/\/[^"]{8,140}.hta"/ ascii wide
      $s2 = /<soap:address location="http[s]?:\/\/[^"]{8,140}mshta.exe"/ ascii wide
   condition:
      ( filesize < 200KB and 1 of them )
}
YARA Detection Rule: CVE_2017_8759_WSDL_in_RTF
Repository: Yara-Rules/rules
Detects: Detects malicious RTF file related CVE-2017-8759
Author: Security Doggo @xdxdxdxdoa
Reference: https://twitter.com/xdxdxdxdoa/status/[PII_REDACTED]99996416

Pattern signatures:
$doc = "d0cf11e0a1b11ae1"
      $obj = "\\objupdate"
      $wsdl = "[PII_REDACTED]006c003d00" nocase
      $http1 = "[PII_REDACTED]0070003a002f002f00" nocase
      $http2 = "[PII_REDACTED][PII_REDACTED]3a002f002f00" nocase
      $http3 = "[PII_REDACTED]003a002f002f00" nocase

Detection condition:
RTFFILE and $obj and $doc and $wsdl and 1 of ($http*)

Full rule:
rule CVE_2017_8759_WSDL_in_RTF {
   meta:
      description = "Detects malicious RTF file related CVE-2017-8759"
      author = "Security Doggo @xdxdxdxdoa"
      reference = "https://twitter.com/xdxdxdxdoa/status/[PII_REDACTED]99996416"
      date = "2017-09-15"
   strings:
      $doc = "d0cf11e0a1b11ae1"
      $obj = "\\objupdate"
      $wsdl = "[PII_REDACTED]006c003d00" nocase
      $http1 = "[PII_REDACTED]0070003a002f002f00" nocase
      $http2 = "[PII_REDACTED][PII_REDACTED]3a002f002f00" nocase
      $http3 = "[PII_REDACTED]003a002f002f00" nocase
   condition:
      RTFFILE and $obj and $doc and $wsdl and 1 of ($http*)
}
YARA Detection Rule: maldoc_API_hashing
Repository: Yara-Rules/rules
Author: Didier Stevens (https://DidierStevens.com)

Pattern signatures:
$a1 = {AC 84 C0 74 07 C1 CF 0D 01 C7 EB F4 81 FF}
        $a2 = {AC 84 C0 74 07 C1 CF 07 01 C7 EB F4 81 FF}

Detection condition:
any of them

Full rule:
rule maldoc_API_hashing : maldoc
{
    meta:
        author = "Didier Stevens (https://DidierStevens.com)"
    strings:
        $a1 = {AC 84 C0 74 07 C1 CF 0D 01 C7 EB F4 81 FF}
        $a2 = {AC 84 C0 74 07 C1 CF 07 01 C7 EB F4 81 FF}
    condition:
        any of them
}
YARA Detection Rule: maldoc_function_prolog_signature
Repository: Yara-Rules/rules
Author: Didier Stevens (https://DidierStevens.com)

Pattern signatures:
$a1 = {55 8B EC 81 EC}
        $a2 = {55 8B EC 83 C4}
        $a3 = {55 8B EC E8}
        $a4 = {55 8B EC E9}
        $a5 = {55 8B EC EB}

Detection condition:
any of them

Full rule:
rule maldoc_function_prolog_signature : maldoc
{
    meta:
        author = "Didier Stevens (https://DidierStevens.com)"
    strings:
        $a1 = {55 8B EC 81 EC}
        $a2 = {55 8B EC 83 C4}
        $a3 = {55 8B EC E8}
        $a4 = {55 8B EC E9}
        $a5 = {55 8B EC EB}
    condition:
        any of them
}
YARA Detection Rule: maldoc_structured_exception_handling
Repository: Yara-Rules/rules
Author: Didier Stevens (https://DidierStevens.com)

Pattern signatures:
$a1 = {64 8B (05|0D|15|1D|25|2D|35|3D) 00 00 00 00}
        $a2 = {64 A1 00 00 00 00}

Detection condition:
any of them

Full rule:
rule maldoc_structured_exception_handling : maldoc
{
    meta:
        author = "Didier Stevens (https://DidierStevens.com)"
    strings:
        $a1 = {64 8B (05|0D|15|1D|25|2D|35|3D) 00 00 00 00}
        $a2 = {64 A1 00 00 00 00}
    condition:
        any of them
}
YARA Detection Rule: maldoc_indirect_function_call_1
Repository: Yara-Rules/rules
Author: Didier Stevens (https://DidierStevens.com)

Pattern signatures:
$a = {FF 75 ?? FF 55 ??}

Detection condition:
for any i in (1..#a): (uint8(@a[i] + 2) == uint8(@a[i] + 5))

Full rule:
rule maldoc_indirect_function_call_1 : maldoc
{
    meta:
        author = "Didier Stevens (https://DidierStevens.com)"
    strings:
        $a = {FF 75 ?? FF 55 ??}
    condition:
        for any i in (1..#a): (uint8(@a[i] + 2) == uint8(@a[i] + 5))
}
YARA Detection Rule: maldoc_indirect_function_call_2
Repository: Yara-Rules/rules
Author: Didier Stevens (https://DidierStevens.com)

Pattern signatures:
$a = {FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ??}

Detection condition:
for any i in (1..#a): ((uint8(@a[i] + 2) == uint8(@a[i] + 8)) and (uint8(@a[i] + 3) == uint8(@a[i] + 9)) and (uint8(@a[i] + 4) == uint8(@a[i] + 10)) and (uint8(@a[i] + 5) == uint8(@a[i] + 11)))

Full rule:
rule maldoc_indirect_function_call_2 : maldoc
{
    meta:
        author = "Didier Stevens (https://DidierStevens.com)"
    strings:
        $a = {FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ??}
    condition:
        for any i in (1..#a): ((uint8(@a[i] + 2) == uint8(@a[i] + 8)) and (uint8(@a[i] + 3) == uint8(@a[i] + 9)) and (uint8(@a[i] + 4) == uint8(@a[i] + 10)) and (uint8(@a[i] + 5) == uint8(@a[i] + 11)))
}
YARA Detection Rule: maldoc_indirect_function_call_3
Repository: Yara-Rules/rules
Author: Didier Stevens (https://DidierStevens.com)

Pattern signatures:
$a = {FF B7 ?? ?? ?? ?? FF 57 ??}

Detection condition:
$a

Full rule:
rule maldoc_indirect_function_call_3 : maldoc
{
    meta:
        author = "Didier Stevens (https://DidierStevens.com)"
    strings:
        $a = {FF B7 ?? ?? ?? ?? FF 57 ??}
    condition:
        $a
}
YARA Detection Rule: maldoc_find_kernel32_base_method_1
Repository: Yara-Rules/rules
Author: Didier Stevens (https://DidierStevens.com)

Pattern signatures:
$a1 = {64 8B (05|0D|15|1D|25|2D|35|3D) 30 00 00 00}
        $a2 = {64 A1 30 00 00 00}

Detection condition:
any of them

Full rule:
rule maldoc_find_kernel32_base_method_1 : maldoc
{
    meta:
        author = "Didier Stevens (https://DidierStevens.com)"
    strings:
        $a1 = {64 8B (05|0D|15|1D|25|2D|35|3D) 30 00 00 00}
        $a2 = {64 A1 30 00 00 00}
    condition:
        any of them
}
YARA Detection Rule: maldoc_find_kernel32_base_method_2
Repository: Yara-Rules/rules
Author: Didier Stevens (https://DidierStevens.com)

Pattern signatures:
$a = {31 ?? ?? 30 64 8B ??}

Detection condition:
for any i in (1..#a): ((uint8(@a[i] + 1) >= 0xC0) and (((uint8(@a[i] + 1) & 0x38) >> 3) == (uint8(@a[i] + 1) & 0x07)) and ((uint8(@a[i] + 2) & 0xF8) == 0xA0) and (uint8(@a[i] + 6) <= 0x3F) and (((uint8(@a[i] + 6) & 0x38) >> 3) != (uint8(@a[i] + 6) & 0x07)))

Full rule:
rule maldoc_find_kernel32_base_method_2 : maldoc
{
    meta:
        author = "Didier Stevens (https://DidierStevens.com)"
    strings:
        $a = {31 ?? ?? 30 64 8B ??}
    condition:
        for any i in (1..#a): ((uint8(@a[i] + 1) >= 0xC0) and (((uint8(@a[i] + 1) & 0x38) >> 3) == (uint8(@a[i] + 1) & 0x07)) and ((uint8(@a[i] + 2) & 0xF8) == 0xA0) and (uint8(@a[i] + 6) <= 0x3F) and (((uint8(@a[i] + 6) & 0x38) >> 3) != (uint8(@a[i] + 6) & 0x07)))
}
YARA Detection Rule: maldoc_find_kernel32_base_method_3
Repository: Yara-Rules/rules
Author: Didier Stevens (https://DidierStevens.com)

Pattern signatures:
$a = {68 30 00 00 00 (58|59|5A|5B|5C|5D|5E|5F) 64 8B ??}

Detection condition:
for any i in (1..#a): (((uint8(@a[i] + 5) & 0x07) == (uint8(@a[i] + 8) & 0x07)) and (uint8(@a[i] + 8) <= 0x3F) and (((uint8(@a[i] + 8) & 0x38) >> 3) != (uint8(@a[i] + 8) & 0x07)))

Full rule:
rule maldoc_find_kernel32_base_method_3 : maldoc
{
    meta:
        author = "Didier Stevens (https://DidierStevens.com)"
    strings:
        $a = {68 30 00 00 00 (58|59|5A|5B|5C|5D|5E|5F) 64 8B ??}
    condition:
        for any i in (1..#a): (((uint8(@a[i] + 5) & 0x07) == (uint8(@a[i] + 8) & 0x07)) and (uint8(@a[i] + 8) <= 0x3F) and (((uint8(@a[i] + 8) & 0x38) >> 3) != (uint8(@a[i] + 8) & 0x07)))
}
YARA Detection Rule: maldoc_getEIP_method_1
Repository: Yara-Rules/rules
Author: Didier Stevens (https://DidierStevens.com)

Pattern signatures:
$a = {E8 00 00 00 00 (58|59|5A|5B|5C|5D|5E|5F)}

Detection condition:
$a

Full rule:
rule maldoc_getEIP_method_1 : maldoc
{
    meta:
        author = "Didier Stevens (https://DidierStevens.com)"
    strings:
        $a = {E8 00 00 00 00 (58|59|5A|5B|5C|5D|5E|5F)}
    condition:
        $a
}
YARA Detection Rule: maldoc_getEIP_method_4
Repository: Yara-Rules/rules
Author: Didier Stevens (https://DidierStevens.com)

Pattern signatures:
$a1 = {D9 EE D9 74 24 F4 (58|59|5A|5B|5C|5D|5E|5F)}
        $a2 = {D9 EE 9B D9 74 24 F4 (58|59|5A|5B|5C|5D|5E|5F)}

Detection condition:
any of them

Full rule:
rule maldoc_getEIP_method_4 : maldoc
{
    meta:
        author = "Didier Stevens (https://DidierStevens.com)"
    strings:
        $a1 = {D9 EE D9 74 24 F4 (58|59|5A|5B|5C|5D|5E|5F)}
        $a2 = {D9 EE 9B D9 74 24 F4 (58|59|5A|5B|5C|5D|5E|5F)}
    condition:
        any of them
}
YARA Detection Rule: maldoc_suspicious_strings
Repository: Yara-Rules/rules
Author: Didier Stevens (https://DidierStevens.com)

Pattern signatures:
$a01 = "CloseHandle"
        $a02 = "CreateFile"
        $a03 = "GetProcAddr"
        $a04 = "GetSystemDirectory"
        $a05 = "GetTempPath"
        $a06 = "GetWindowsDirectory"
        $a07 = "IsBadReadPtr"
        $a08 = "IsBadWritePtr"
        $a09 = "LoadLibrary"
        $a10 = "ReadFile"
        $a11 = "SetFilePointer"
        $a12 = "ShellExecute"
        $a13 = "UrlDownloadToFile"
        $a14 = "VirtualAlloc"
        $a15 = "WinExec"
        $a16 = "WriteFile"

Detection condition:
any of them

Full rule:
rule maldoc_suspicious_strings : maldoc
{
    meta:
        author = "Didier Stevens (https://DidierStevens.com)"
    strings:
        $a01 = "CloseHandle"
        $a02 = "CreateFile"
        $a03 = "GetProcAddr"
        $a04 = "GetSystemDirectory"
        $a05 = "GetTempPath"
        $a06 = "GetWindowsDirectory"
        $a07 = "IsBadReadPtr"
        $a08 = "IsBadWritePtr"
        $a09 = "LoadLibrary"
        $a10 = "ReadFile"
        $a11 = "SetFilePointer"
        $a12 = "ShellExecute"
        $a13 = "UrlDownloadToFile"
        $a14 = "VirtualAlloc"
        $a15 = "WinExec"
        $a16 = "WriteFile"
    condition:
        any of them
}
YARA Detection Rule: mwi_document
Repository: Yara-Rules/rules
Detects: MWI generated document
Author: @Ydklijnsma

Pattern signatures:
$field_creation_tag = "{\\field{\\*\\fldinst { INCLUDEPICTURE"
        $mwistat_url = ".php?id="
        $field_closing_tag = "\\\\* MERGEFORMAT \\\\d}}{\\fldrslt}}"

Detection condition:
all of them

Full rule:
rule mwi_document: exploitdoc maldoc
{
    meta:
        description = "MWI generated document"
        author = "@Ydklijnsma"
        source = "http://blog.0x3a.com/post/[PII_REDACTED]4/analysis-of-a-microsoft-word-intruder-sample"

      strings:
        $field_creation_tag = "{\\field{\\*\\fldinst { INCLUDEPICTURE"
        $mwistat_url = ".php?id="
        $field_closing_tag = "\\\\* MERGEFORMAT \\\\d}}{\\fldrslt}}"

    condition:
        all of them
}
YARA Detection Rule: macrocheck
Repository: Yara-Rules/rules
Detects: Identify office documents with the MACROCHECK credential stealer in them.  It can be run against .doc files or VBA macros extraced from .docx files (vbaProject.bin files).
Author: Fireeye Labs
Reference: https://www.fireeye.com/blog/threat-research/2014/11/fin4_stealing_insid.html

Pattern signatures:
$PARAMpword = "pword=" ascii wide
        $PARAMmsg = "msg=" ascii wide
        $PARAMuname = "uname=" ascii
        $userform = "UserForm" ascii wide
        $userloginform = "UserLoginForm" ascii wide
        $invalid = "Invalid username or password" ascii wide
        $up1 = "uploadPOST" ascii wide
        $up2 = "postUpload" ascii wide

Detection condition:
all of ($PARAM*) or (($invalid or $userloginform or $userform) and ($up1 or $up2))

Full rule:
rule macrocheck : maldoc
{
    meta:
        Author      = "Fireeye Labs"
        Date        = "2014/11/30" 
        Description = "Identify office documents with the MACROCHECK credential stealer in them.  It can be run against .doc files or VBA macros extraced from .docx files (vbaProject.bin files)."
        Reference   = "https://www.fireeye.com/blog/threat-research/2014/11/fin4_stealing_insid.html"

    strings:
        $PARAMpword = "pword=" ascii wide
        $PARAMmsg = "msg=" ascii wide
        $PARAMuname = "uname=" ascii
        $userform = "UserForm" ascii wide
        $userloginform = "UserLoginForm" ascii wide
        $invalid = "Invalid username or password" ascii wide
        $up1 = "uploadPOST" ascii wide
        $up2 = "postUpload" ascii wide
 
    condition:
        all of ($PARAM*) or (($invalid or $userloginform or $userform) and ($up1 or $up2))
}
YARA Detection Rule: office_document_vba
Repository: Yara-Rules/rules
Detects: Office document with embedded VBA
Author: Jean-Philippe Teissier / @Jipe_
Reference: https://github.com/jipegit/

Pattern signatures:
$officemagic = { D0 CF 11 E0 A1 B1 1A E1 }
		$zipmagic = "PK"

		$97str1 = "_VBA_PROJECT_CUR" wide
		$97str2 = "VBAProject"
		$97str3 = { 41 74 74 72 69 62 75 74 00 65 20 56 42 5F }

		$xmlstr1 = "vbaProject.bin"
		$xmlstr2 = "vbaData.xml"

Detection condition:
($officemagic at 0 and any of ($97str*)) or ($zipmagic at 0 and any of ($xmlstr*))

Full rule:
rule office_document_vba : maldoc
{
	meta:
		description = "Office document with embedded VBA"
		author = "Jean-Philippe Teissier / @Jipe_"
		date = "2013-12-17"
		reference = "https://github.com/jipegit/"

	strings:
		$officemagic = { D0 CF 11 E0 A1 B1 1A E1 }
		$zipmagic = "PK"

		$97str1 = "_VBA_PROJECT_CUR" wide
		$97str2 = "VBAProject"
		$97str3 = { 41 74 74 72 69 62 75 74 00 65 20 56 42 5F }

		$xmlstr1 = "vbaProject.bin"
		$xmlstr2 = "vbaData.xml"

	condition:
		($officemagic at 0 and any of ($97str*)) or ($zipmagic at 0 and any of ($xmlstr*))
}
YARA Detection Rule: Office_AutoOpen_Macro
Repository: Yara-Rules/rules
Detects: Detects an Microsoft Office file that contains the AutoOpen Macro function
Author: Florian Roth

Pattern signatures:
$s1 = "AutoOpen" ascii fullword
		$s2 = "Macros" wide fullword

Detection condition:
uint32be(0) == 0xd0cf11e0 and all of ($s*) and filesize < 300000

Full rule:
rule Office_AutoOpen_Macro : maldoc {
	meta:
		description = "Detects an Microsoft Office file that contains the AutoOpen Macro function"
		author = "Florian Roth"
		date = "2015-05-28"
		score = 60
		hash1 = "4d00695d5011427efc33c9722c61ced2"
		hash2 = "63f6b20cb39630b13c14823874bd3743"
		hash3 = "66e67c2d84af85a569a[PII_REDACTED]4e6"
		hash4 = "a3035716fe[PII_REDACTED]876c2bde9d98"
		hash5 = "7c06cab49b[PII_REDACTED]b16f15708345"
		hash6 = "bfc30332b7b91572bfe712b656ea8a0c"
		hash7 = "25285b8fe2c41bd54079c92c1b761381"
	strings:
		$s1 = "AutoOpen" ascii fullword
		$s2 = "Macros" wide fullword
	condition:
		uint32be(0) == 0xd0cf11e0 and all of ($s*) and filesize < 300000
}
YARA Detection Rule: Embedded_EXE_Cloaking
Repository: Yara-Rules/rules
Detects: Detects an embedded executable in a non-executable file
Author: Florian Roth

Pattern signatures:
$noex_png = { 89 50 4E 47 }
        $noex_pdf = { 25 50 44 46 }
        $noex_rtf = { 7B 5C 72 74 66 31 }
        $noex_jpg = { FF D8 FF E0 }
        $noex_gif = { 47 49 46 38 }
        $mz  = { 4D 5A }
        $a1 = "This program cannot be run in DOS mode"
        $a2 = "This program must be run under Win32"

Detection condition:
(
            ( $noex_png at 0 ) or
            ( $noex_pdf at 0 ) or
            ( $noex_rtf at 0 ) or
            ( $noex_jpg at 0 ) or
            ( $noex_gif at 0 )
        )
        and
        for any i in (1..#mz): ( @a1 < ( @mz[i] + 200 ) or @a2 < ( @mz[i] + 200 ) )

Full rule:
rule Embedded_EXE_Cloaking : maldoc {
    meta:
        description = "Detects an embedded executable in a non-executable file"
        author = "Florian Roth"
        date = "2015/02/27"
        score = 80
    strings:
        $noex_png = { 89 50 4E 47 }
        $noex_pdf = { 25 50 44 46 }
        $noex_rtf = { 7B 5C 72 74 66 31 }
        $noex_jpg = { FF D8 FF E0 }
        $noex_gif = { 47 49 46 38 }
        $mz  = { 4D 5A }
        $a1 = "This program cannot be run in DOS mode"
        $a2 = "This program must be run under Win32"       
    condition:
        (
            ( $noex_png at 0 ) or
            ( $noex_pdf at 0 ) or
            ( $noex_rtf at 0 ) or
            ( $noex_jpg at 0 ) or
            ( $noex_gif at 0 )
        )
        and
        for any i in (1..#mz): ( @a1 < ( @mz[i] + 200 ) or @a2 < ( @mz[i] + 200 ) )
}