deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: FeliksPack3___Scanners_ipscan
Repository: Neo23x0/signature-base
Detects: Auto-generated rule on file ipscan.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s2 = "WCAP;}ECTED"
      $s4 = "NotSupported"
      $s6 = "SCAN.VERSION{_"

Detection condition:
all of them

Full rule:
rule FeliksPack3___Scanners_ipscan {
   meta:
      description = "Auto-generated rule on file ipscan.exe"
      author = "yarGen Yara Rule Generator by Florian Roth"
      hash = "6c1bcf0b1297689c8c4c12cc70996a75"
      id = "8360b268-3434-5142-9248-40b7a1589be9"
   strings:
      $s2 = "WCAP;}ECTED"
      $s4 = "NotSupported"
      $s6 = "SCAN.VERSION{_"
   condition:
      all of them
}
YARA Detection Rule: CGISscan_CGIScan
Repository: Neo23x0/signature-base
Detects: Auto-generated rule on file CGIScan.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s1 = "Wang Products" fullword wide
      $s2 = "WSocketResolveHost: Cannot convert host address '%s'"
      $s3 = "tcp is the only protocol supported thru socks server"

Detection condition:
all of ($s*)

Full rule:
rule CGISscan_CGIScan {
   meta:
      description = "Auto-generated rule on file CGIScan.exe"
      author = "yarGen Yara Rule Generator by Florian Roth"
      hash = "338820e4e8e7c943074d5a5bc832458a"
      id = "60bd5038-a308-55fd-85bb-2c4183f1c951"
   strings:
      $s1 = "Wang Products" fullword wide
      $s2 = "WSocketResolveHost: Cannot convert host address '%s'"
      $s3 = "tcp is the only protocol supported thru socks server"
   condition:
      all of ($s*)
}
YARA Detection Rule: IP_Stealing_Utilities
Repository: Neo23x0/signature-base
Detects: Auto-generated rule on file IP Stealing Utilities.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s0 = "DarkKnight"
      $s9 = "IPStealerUtilities"

Detection condition:
all of them

Full rule:
rule IP_Stealing_Utilities {
   meta:
      description = "Auto-generated rule on file IP Stealing Utilities.exe"
      author = "yarGen Yara Rule Generator by Florian Roth"
      hash = "65646e10fb15a2940a37c5ab9f59c7fc"
      id = "3a947e9c-d707-5819-88f2[PII_REDACTED]48"
   strings:
      $s0 = "DarkKnight"
      $s9 = "IPStealerUtilities"
   condition:
      all of them
}
YARA Detection Rule: SuperScan4
Repository: Neo23x0/signature-base
Detects: Auto-generated rule on file SuperScan4.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s2 = " td class=\"summO1\">"
      $s6 = "REM'EBAqRISE"
      $s7 = "CorExitProcess'msc#e"

Detection condition:
all of them

Full rule:
rule SuperScan4 {
   meta:
      description = "Auto-generated rule on file SuperScan4.exe"
      author = "yarGen Yara Rule Generator by Florian Roth"
      hash = "78f76428ede30e555044b83c47bc86f0"
      id = "bd353382-ffa2-56c5-b842-1ffc94d6849e"
   strings:
      $s2 = " td class=\"summO1\">"
      $s6 = "REM'EBAqRISE"
      $s7 = "CorExitProcess'msc#e"
   condition:
      all of them

}
YARA Detection Rule: PortRacer
Repository: Neo23x0/signature-base
Detects: Auto-generated rule on file PortRacer.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s0 = "Auto Scroll BOTH Text Boxes"
      $s4 = "Start/Stop Portscanning"
      $s6 = "Auto Save LogFile by pressing STOP"

Detection condition:
all of them

Full rule:
rule PortRacer {
   meta:
      description = "Auto-generated rule on file PortRacer.exe"
      author = "yarGen Yara Rule Generator by Florian Roth"
      hash = "2834a872a0a8da5b1be5db65dfdef388"
      id = "54717938-2f4c-5442-b0ad-40b9acd1101a"
   strings:
      $s0 = "Auto Scroll BOTH Text Boxes"
      $s4 = "Start/Stop Portscanning"
      $s6 = "Auto Save LogFile by pressing STOP"
   condition:
      all of them
}
YARA Detection Rule: scanarator
Repository: Neo23x0/signature-base
Detects: Auto-generated rule on file scanarator.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s4 = "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0"

Detection condition:
all of them

Full rule:
rule scanarator {
   meta:
      description = "Auto-generated rule on file scanarator.exe"
      author = "yarGen Yara Rule Generator by Florian Roth"
      hash = "848bd5a518e0b6c05bd29aceb8536c46"
      id = "dfc3ff29-03b4-58ca-bfe0-c6888fddab67"
   strings:
      $s4 = "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
   condition:
      all of them
}
YARA Detection Rule: aolipsniffer
Repository: Neo23x0/signature-base
Detects: Auto-generated rule on file aolipsniffer.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s0 = "C:\\Program Files\\Microsoft Visual Studio\\VB98\\VB6.OLB"
      $s1 = "dwGetAddressForObject"
      $s2 = "Color Transfer Settings"
      $s3 = "FX Global Lighting Angle"
      $s4 = "Version compatibility info"
      $s5 = "New Windows Thumbnail"
      $s6 = "Layer ID Generator Base"
      $s7 = "Color Halftone Settings"
      $s8 = "C:\\WINDOWS\\SYSTEM\\MSWINSCK.oca"

Detection condition:
all of them

Full rule:
rule aolipsniffer {
   meta:
      description = "Auto-generated rule on file aolipsniffer.exe"
      author = "yarGen Yara Rule Generator by Florian Roth"
      hash = "51565754ea43d2d57b712d9f0a3e62b8"
      id = "f7cc0f31-6ba4-504b-82de-0334257b8a95"
   strings:
      $s0 = "C:\\Program Files\\Microsoft Visual Studio\\VB98\\VB6.OLB"
      $s1 = "dwGetAddressForObject"
      $s2 = "Color Transfer Settings"
      $s3 = "FX Global Lighting Angle"
      $s4 = "Version compatibility info"
      $s5 = "New Windows Thumbnail"
      $s6 = "Layer ID Generator Base"
      $s7 = "Color Halftone Settings"
      $s8 = "C:\\WINDOWS\\SYSTEM\\MSWINSCK.oca"
   condition:
      all of them
}
YARA Detection Rule: _Bitchin_Threads_
Repository: Neo23x0/signature-base
Detects: Auto-generated rule on file =Bitchin Threads=.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s0 = "DarKPaiN"
      $s1 = "=BITCHIN THREADS"

Detection condition:
all of them

Full rule:
rule _Bitchin_Threads_ {
   meta:
      description = "Auto-generated rule on file =Bitchin Threads=.exe"
      author = "yarGen Yara Rule Generator by Florian Roth"
      hash = "7491b138c1ee5a0d9d141fbfd1f0071b"
      id = "3a51e76c-b360-5f10-961c-ecc3ea3fa3c9"
   strings:
      $s0 = "DarKPaiN"
      $s1 = "=BITCHIN THREADS"
   condition:
      all of them
}
YARA Detection Rule: cgis4_cgis4
Repository: Neo23x0/signature-base
Detects: Auto-generated rule on file cgis4.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s0 = ")PuMB_syJ"
      $s1 = "&,fARW>yR"
      $s2 = "m3hm3t_rullaz"
      $s3 = "7Projectc1"
      $s4 = "Ten-GGl\""
      $s5 = "/Moziqlxa"

Detection condition:
all of them

Full rule:
rule cgis4_cgis4 {
   meta:
      description = "Auto-generated rule on file cgis4.exe"
      author = "yarGen Yara Rule Generator by Florian Roth"
      hash = "d658dad1cd759d7f7d67da010e47ca23"
      id = "98fbf445-b7a5-58fa-8f06-34be7321e2eb"
   strings:
      $s0 = ")PuMB_syJ"
      $s1 = "&,fARW>yR"
      $s2 = "m3hm3t_rullaz"
      $s3 = "7Projectc1"
      $s4 = "Ten-GGl\""
      $s5 = "/Moziqlxa"
   condition:
      all of them
}
YARA Detection Rule: portscan
Repository: Neo23x0/signature-base
Detects: Auto-generated rule on file portscan.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s5 = "0    :SCAN BEGUN ON PORT:"
      $s6 = "0    :PORTSCAN READY."

Detection condition:
all of them

Full rule:
rule portscan {
   meta:
      description = "Auto-generated rule on file portscan.exe"
      author = "yarGen Yara Rule Generator by Florian Roth"
      hash = "a8bfdb2a925e89a281956b1e3bb32348"
      id = "967d6e3b-ae0d-5f93-a20d-742fc010608d"
   strings:
      $s5 = "0    :SCAN BEGUN ON PORT:"
      $s6 = "0    :PORTSCAN READY."
   condition:
      all of them
}
YARA Detection Rule: ProPort_zip_Folder_ProPort
Repository: Neo23x0/signature-base
Detects: Auto-generated rule on file ProPort.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s0 = "Corrupt Data!"
      $s1 = "K4p~omkIz"
      $s2 = "DllTrojanScan"
      $s3 = "GetDllInfo"
      $s4 = "Compressed by Petite (c)1999 Ian Luck."
      $s5 = "GetFileCRC32"
      $s6 = "GetTrojanNumber"
      $s7 = "TFAKAbout"

Detection condition:
all of them

Full rule:
rule ProPort_zip_Folder_ProPort {
   meta:
      description = "Auto-generated rule on file ProPort.exe"
      author = "yarGen Yara Rule Generator by Florian Roth"
      hash = "c1937a86939d4d12d10fc44b7ab9ab27"
      id = "cd611f6c-42ed-5cd3-a6ab-7e0970925e61"
   strings:
      $s0 = "Corrupt Data!"
      $s1 = "K4p~omkIz"
      $s2 = "DllTrojanScan"
      $s3 = "GetDllInfo"
      $s4 = "Compressed by Petite (c)1999 Ian Luck."
      $s5 = "GetFileCRC32"
      $s6 = "GetTrojanNumber"
      $s7 = "TFAKAbout"
   condition:
      all of them
}
YARA Detection Rule: StealthWasp_s_Basic_PortScanner_v1_2
Repository: Neo23x0/signature-base
Detects: Auto-generated rule on file StealthWasp's Basic PortScanner v1.2.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s1 = "Basic PortScanner"
      $s6 = "Now scanning port:"

Detection condition:
all of them

Full rule:
rule StealthWasp_s_Basic_PortScanner_v1_2 {
   meta:
      description = "Auto-generated rule on file StealthWasp's Basic PortScanner v1.2.exe"
      author = "yarGen Yara Rule Generator by Florian Roth"
      hash = "7c0f2cab134534cd35964fe4c6a1ff00"
      id = "7f706186-f2e2-5d4d-951a-2ec8fc757cec"
   strings:
      $s1 = "Basic PortScanner"
      $s6 = "Now scanning port:"
   condition:
      all of them
}
YARA Detection Rule: BluesPortScan
Repository: Neo23x0/signature-base
Detects: Auto-generated rule on file BluesPortScan.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s0 = "This program was made by Volker Voss"
      $s1 = "JiBOo~SSB"

Detection condition:
all of them

Full rule:
rule BluesPortScan {
   meta:
      description = "Auto-generated rule on file BluesPortScan.exe"
      author = "yarGen Yara Rule Generator by Florian Roth"
      hash = "6292f5fc737511f91af5e35643fc9eef"
      id = "4bcb8b7c-5e22-5496-9a29-66e85e3c3395"
   strings:
      $s0 = "This program was made by Volker Voss"
      $s1 = "JiBOo~SSB"
   condition:
      all of them
}
YARA Detection Rule: scanarator_iis
Repository: Neo23x0/signature-base
Detects: Auto-generated rule on file iis.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s0 = "example: iis 10.10.10.10"
      $s1 = "send error"

Detection condition:
all of them

Full rule:
rule scanarator_iis {
   meta:
      description = "Auto-generated rule on file iis.exe"
      author = "yarGen Yara Rule Generator by Florian Roth"
      hash = "3a8fc02c62c8dd65e038cc03e5451b6e"
      id = "a467147b-53c8-53db-aa33-5f0e4e066988"
   strings:
      $s0 = "example: iis 10.10.10.10"
      $s1 = "send error"
   condition:
      all of them
}
YARA Detection Rule: stealth_Stealth
Repository: Neo23x0/signature-base
Detects: Auto-generated rule on file Stealth.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s3 = "<table width=\"60%\" bgcolor=\"black\" cellspacing=\"0\" cellpadding=\"2\" border=\"1\" bordercolor=\"white\"><tr><td>"
      $s6 = "This tool may be used only by system administrators. I am not responsible for "

Detection condition:
all of them

Full rule:
rule stealth_Stealth {
   meta:
      description = "Auto-generated rule on file Stealth.exe"
      author = "yarGen Yara Rule Generator by Florian Roth"
      hash = "8ce3a386ce0eae10fc2ce0177bbc8ffa"
      id = "5f45882e-3e27-596d-8725-fad380e1c297"
   strings:
      $s3 = "<table width=\"60%\" bgcolor=\"black\" cellspacing=\"0\" cellpadding=\"2\" border=\"1\" bordercolor=\"white\"><tr><td>"
      $s6 = "This tool may be used only by system administrators. I am not responsible for "
   condition:
      all of them
}
YARA Detection Rule: Angry_IP_Scanner_v2_08_ipscan
Repository: Neo23x0/signature-base
Detects: Auto-generated rule on file ipscan.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s0 = "_H/EnumDisplay/"
      $s5 = "ECTED.MSVCRT0x"
      $s8 = "NotSupported7"

Detection condition:
all of them

Full rule:
rule Angry_IP_Scanner_v2_08_ipscan {
   meta:
      description = "Auto-generated rule on file ipscan.exe"
      author = "yarGen Yara Rule Generator by Florian Roth"
      hash = "70cf2c09776a29c3e837cb79d291514a"
      id = "5fbcbb95-6cd4-5587-bf44-5b5ed133ce5e"
   strings:
      $s0 = "_H/EnumDisplay/"
      $s5 = "ECTED.MSVCRT0x"
      $s8 = "NotSupported7"
   condition:
      all of them
}
YARA Detection Rule: crack_Loader
Repository: Neo23x0/signature-base
Detects: Auto-generated rule on file Loader.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s0 = "NeoWait.exe"
      $s1 = "RRRRRRRW"

Detection condition:
all of them

Full rule:
rule crack_Loader {
   meta:
      description = "Auto-generated rule on file Loader.exe"
      author = "yarGen Yara Rule Generator by Florian Roth"
      hash = "f4f79358a6c600c1f0ba1f7e4879a16d"
      id = "0c4c7b69-7739-5c1b-8c7c-4aaa724e4455"
   strings:
      $s0 = "NeoWait.exe"
      $s1 = "RRRRRRRW"
   condition:
      all of them
}
YARA Detection Rule: CN_GUI_Scanner
Repository: Neo23x0/signature-base
Detects: Detects an unknown GUI scanner tool - CN background
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "good.txt" fullword ascii
      $s2 = "IP.txt" fullword ascii
      $s3 = "xiaoyuer" fullword ascii
      $s0w = "ssh(" wide
      $s1w = ").exe" fullword wide

Detection condition:
all of them

Full rule:
rule CN_GUI_Scanner {
   meta:
      description = "Detects an unknown GUI scanner tool - CN background"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      hash = "3c67bbb1911cdaef5e675c56145e1112"
      score = 65
      date = "04.10.2014"
      id = "ca88d4d3-5d18-5856-874f-e50deceef54f"
   strings:
      $s1 = "good.txt" fullword ascii
      $s2 = "IP.txt" fullword ascii
      $s3 = "xiaoyuer" fullword ascii
      $s0w = "ssh(" wide
      $s1w = ").exe" fullword wide
   condition:
      all of them
}
YARA Detection Rule: CN_Packed_Scanner
Repository: Neo23x0/signature-base
Detects: Suspiciously packed executable
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "kernel32.dll" fullword ascii
      $s2 = "CRTDLL.DLL" fullword ascii
      $s3 = "__GetMainArgs" fullword ascii
      $s4 = "WS2_32.DLL" fullword ascii

Detection condition:
all of them and filesize < 180KB and filesize > 70KB

Full rule:
rule CN_Packed_Scanner {
   meta:
      description = "Suspiciously packed executable"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      hash = "6323b51c116a77e3fba98f7bb7ff4ac6"
      score = 40
      date = "06.10.2014"
      id = "a11c4ee6-7244-5601-af26-a45f9fdc8e1b"
   strings:
      $s1 = "kernel32.dll" fullword ascii
      $s2 = "CRTDLL.DLL" fullword ascii
      $s3 = "__GetMainArgs" fullword ascii
      $s4 = "WS2_32.DLL" fullword ascii
   condition:
      all of them and filesize < 180KB and filesize > 70KB
}
YARA Detection Rule: Tiny_Network_Tool_Generic
Repository: Neo23x0/signature-base
Detects: Tiny tool with suspicious function imports. (Rule based on WinEggDrop Scanner samples)
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "KERNEL32.DLL" fullword ascii
      $s1 = "CRTDLL.DLL" fullword ascii
      $s3 = "LoadLibraryA" fullword ascii
      $s4 = "GetProcAddress" fullword ascii

      $y1 = "WININET.DLL" fullword ascii
      $y2 = "atoi" fullword ascii

      $x1 = "ADVAPI32.DLL" fullword ascii
      $x2 = "USER32.DLL" fullword ascii
      $x3 = "wsock32.dll" fullword ascii
      $x4 = "FreeSid" fullword ascii
      $x5 = "atoi" fullword ascii

      $z1 = "ADVAPI32.DLL" fullword ascii
      $z2 = "USER32.DLL" fullword ascii
      $z3 = "FreeSid" fullword ascii
      $z4 = "ToAscii" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and all of ($s*) and (all of ($y*) or all of ($x*) or all of ($z*)) and filesize < 15KB

Full rule:
rule Tiny_Network_Tool_Generic: FILE {
   meta:
      description = "Tiny tool with suspicious function imports. (Rule based on WinEggDrop Scanner samples)"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "08.10.2014"
      score = 40
      hash0 = "9e1ab25a937f39ed8b031cd8cfbc4c07"
      hash1 = "cafc31d39c1e4721af3ba519759884b9"
      hash2 = "8e635b9a1e5aa5ef84bfa619bd2a1f92"
      id = "04b1c2c6-605c-52d5-aa07-f3b77a6c4593"
   strings:
      $s0 = "KERNEL32.DLL" fullword ascii
      $s1 = "CRTDLL.DLL" fullword ascii
      $s3 = "LoadLibraryA" fullword ascii
      $s4 = "GetProcAddress" fullword ascii

      $y1 = "WININET.DLL" fullword ascii
      $y2 = "atoi" fullword ascii

      $x1 = "ADVAPI32.DLL" fullword ascii
      $x2 = "USER32.DLL" fullword ascii
      $x3 = "wsock32.dll" fullword ascii
      $x4 = "FreeSid" fullword ascii
      $x5 = "atoi" fullword ascii

      $z1 = "ADVAPI32.DLL" fullword ascii
      $z2 = "USER32.DLL" fullword ascii
      $z3 = "FreeSid" fullword ascii
      $z4 = "ToAscii" fullword ascii
   condition:
      uint16(0) == 0x5a4d and all of ($s*) and (all of ($y*) or all of ($x*) or all of ($z*)) and filesize < 15KB
}
YARA Detection Rule: Beastdoor_Backdoor
Repository: Neo23x0/signature-base
Detects: Detects the backdoor Beastdoor
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Redirect SPort RemoteHost RPort  -->Port Redirector" fullword
      $s1 = "POST /scripts/WWPMsg.dll HTTP/1.0" fullword
      $s2 = "http://IP/a.exe a.exe            -->Download A File" fullword
      $s7 = "Host: wwp.mirabilis.com:80" fullword
      $s8 = "%s -Set Port PortNumber              -->Set The Service Port" fullword
      $s11 = "Shell                            -->Get A Shell" fullword
      $s14 = "DeleteService ServiceName        -->Delete A Service" fullword
      $s15 = "Getting The UserName(%c%s%c)-->ID(0x%s) Successfully" fullword
      $s17 = "%s -Set ServiceName ServiceName      -->Set The Service Name" fullword

Detection condition:
2 of them

Full rule:
rule Beastdoor_Backdoor {
   meta:
      description = "Detects the backdoor Beastdoor"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      score = 55
      hash = "5ab10dda548cb821d7c15ebcd0a9f1ec6ef1a14abcc8ad4056944d060c49535a"
      id = "64f67233-6677-53c8-b212-f1a425f78803"
   strings:
      $s0 = "Redirect SPort RemoteHost RPort  -->Port Redirector" fullword
      $s1 = "POST /scripts/WWPMsg.dll HTTP/1.0" fullword
      $s2 = "http://IP/a.exe a.exe            -->Download A File" fullword
      $s7 = "Host: wwp.mirabilis.com:80" fullword
      $s8 = "%s -Set Port PortNumber              -->Set The Service Port" fullword
      $s11 = "Shell                            -->Get A Shell" fullword
      $s14 = "DeleteService ServiceName        -->Delete A Service" fullword
      $s15 = "Getting The UserName(%c%s%c)-->ID(0x%s) Successfully" fullword
      $s17 = "%s -Set ServiceName ServiceName      -->Set The Service Name" fullword
   condition:
      2 of them
}
YARA Detection Rule: Powershell_Netcat
Repository: Neo23x0/signature-base
Detects: Detects a Powershell version of the Netcat network hacking tool
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "[ValidateRange(1, 65535)]" fullword
      $s1 = "$Client = New-Object -TypeName System.Net.Sockets.TcpClient" fullword
      $s2 = "$Buffer = New-Object -TypeName System.Byte[] -ArgumentList $Client.ReceiveBufferSize" fullword

Detection condition:
all of them

Full rule:
rule Powershell_Netcat {
   meta:
      description = "Detects a Powershell version of the Netcat network hacking tool"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      score = 60
      date = "10.10.2014"
      id = "e4b018c0-3214-5102-93b1-6a048324f9dd"
   strings:
      $s0 = "[ValidateRange(1, 65535)]" fullword
      $s1 = "$Client = New-Object -TypeName System.Net.Sockets.TcpClient" fullword
      $s2 = "$Buffer = New-Object -TypeName System.Byte[] -ArgumentList $Client.ReceiveBufferSize" fullword
   condition:
      all of them
}
YARA Detection Rule: Chinese_Hacktool_1014
Repository: Neo23x0/signature-base
Detects: Detects a chinese hacktool with unknown use
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "IEXT2_IDC_HORZLINEMOVECURSOR" fullword wide
      $s1 = "msctls_progress32" fullword wide
      $s2 = "Reply-To: %s" fullword ascii
      $s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii
      $s4 = "html htm htx asp" fullword ascii

Detection condition:
all of them

Full rule:
rule Chinese_Hacktool_1014 {
   meta:
      description = "Detects a chinese hacktool with unknown use"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      score = 60
      date = "10.10.2014"
      hash = "98c07a62f7f0842bcdbf941170f34990"
      id = "e5db5f58-a1fd-51e0-9037-337fcca71f11"
   strings:
      $s0 = "IEXT2_IDC_HORZLINEMOVECURSOR" fullword wide
      $s1 = "msctls_progress32" fullword wide
      $s2 = "Reply-To: %s" fullword ascii
      $s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii
      $s4 = "html htm htx asp" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: CN_Hacktool_BAT_PortsOpen
Repository: Neo23x0/signature-base
Detects: Detects a chinese BAT hacktool for local port evaluation
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "for /f \"skip=4 tokens=2,5\" %%a in ('netstat -ano -p TCP') do (" ascii
      $s1 = "in ('tasklist /fi \"PID eq %%b\" /FO CSV') do " ascii
      $s2 = "@echo off" ascii

Detection condition:
all of them

Full rule:
rule CN_Hacktool_BAT_PortsOpen {
   meta:
      description = "Detects a chinese BAT hacktool for local port evaluation"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      score = 60
      date = "12.10.2014"
      id = "55c3f678-ba70-5a4a-b288-9d0953eff968"
   strings:
      $s0 = "for /f \"skip=4 tokens=2,5\" %%a in ('netstat -ano -p TCP') do (" ascii
      $s1 = "in ('tasklist /fi \"PID eq %%b\" /FO CSV') do " ascii
      $s2 = "@echo off" ascii
   condition:
      all of them
}
YARA Detection Rule: CN_Hacktool_SSPort_Portscanner
Repository: Neo23x0/signature-base
Detects: Detects a chinese Portscanner named SSPort
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Golden Fox" fullword wide
      $s1 = "Syn Scan Port" fullword wide
      $s2 = "CZ88.NET" fullword wide

Detection condition:
all of them

Full rule:
rule CN_Hacktool_SSPort_Portscanner {
   meta:
      description = "Detects a chinese Portscanner named SSPort"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      score = 70
      date = "12.10.2014"
      id = "38cc8830-efd3-51b7-8ac6-c9bf468212cb"
   strings:
      $s0 = "Golden Fox" fullword wide
      $s1 = "Syn Scan Port" fullword wide
      $s2 = "CZ88.NET" fullword wide
   condition:
      all of them
}