deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: php_reverse_shell
Repository: Neo23x0/signature-base
Detects: Laudanum Injector Tools - file php-reverse-shell.php
Author: Florian Roth (Nextron Systems)
Reference: http://laudanum.inguardians.com/

Pattern signatures:
$s1 = "$process = proc_open($shell, $descriptorspec, $pipes);" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "printit(\"Successfully opened reverse shell to $ip:$port\");" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "$input = fread($pipes[1], $chunk_size);" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
filesize < 15KB and all of them

Full rule:
rule php_reverse_shell {
	meta:
		description = "Laudanum Injector Tools - file php-reverse-shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "3ef03bbe3649535a03315dcfc1a1208a09cea49d"
		id = "306d150f-95a8-57fd-8f5e-786c429af6b3"
	strings:
		$s1 = "$process = proc_open($shell, $descriptorspec, $pipes);" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "printit(\"Successfully opened reverse shell to $ip:$port\");" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "$input = fread($pipes[1], $chunk_size);" fullword ascii /* PEStudio Blacklist: strings */
	condition:
		filesize < 15KB and all of them
}
YARA Detection Rule: php_dns
Repository: Neo23x0/signature-base
Detects: Laudanum Injector Tools - file dns.php
Author: Florian Roth (Nextron Systems)
Reference: http://laudanum.inguardians.com/

Pattern signatures:
$s1 = "$query = isset($_POST['query']) ? $_POST['query'] : '';" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "$result = dns_get_record($query, $types[$type], $authns, $addtl);" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "if ($_SERVER[\"REMOTE_ADDR\"] == $IP)" fullword ascii /* PEStudio Blacklist: strings */
		$s4 = "foreach (array_keys($types) as $t) {" fullword ascii

Detection condition:
filesize < 15KB and all of them

Full rule:
rule php_dns {
	meta:
		description = "Laudanum Injector Tools - file dns.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "01d5d16d876c55d77e094ce2b9c237de43b21a16"
		id = "a52e453b-07aa-58b9-91e7-f2426a8e8976"
	strings:
		$s1 = "$query = isset($_POST['query']) ? $_POST['query'] : '';" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "$result = dns_get_record($query, $types[$type], $authns, $addtl);" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "if ($_SERVER[\"REMOTE_ADDR\"] == $IP)" fullword ascii /* PEStudio Blacklist: strings */
		$s4 = "foreach (array_keys($types) as $t) {" fullword ascii
	condition:
		filesize < 15KB and all of them
}
YARA Detection Rule: WEB_INF_web
Repository: Neo23x0/signature-base
Detects: Laudanum Injector Tools - file web.xml
Author: Florian Roth (Nextron Systems)
Reference: http://laudanum.inguardians.com/

Pattern signatures:
$s1 = "<servlet-name>Command</servlet-name>" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "<jsp-file>/cmd.jsp</jsp-file>" fullword ascii

Detection condition:
filesize < 1KB and all of them

Full rule:
rule WEB_INF_web {
	meta:
		description = "Laudanum Injector Tools - file web.xml"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "0251baed0a16c451f9d67dddce04a45dc26cb4a3"
		id = "8d0a008c-56d1-59ef-8521-0697add21ba9"
	strings:
		$s1 = "<servlet-name>Command</servlet-name>" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "<jsp-file>/cmd.jsp</jsp-file>" fullword ascii
	condition:
		filesize < 1KB and all of them
}
YARA Detection Rule: jsp_cmd
Repository: Neo23x0/signature-base
Detects: Laudanum Injector Tools - file cmd.war
Author: Florian Roth (Nextron Systems)
Reference: http://laudanum.inguardians.com/

Pattern signatures:
$s0 = "cmd.jsp}" fullword ascii
		$s1 = "cmd.jspPK" fullword ascii
		$s2 = "WEB-INF/web.xml" fullword ascii /* Goodware String - occured 1 times */
		$s3 = "WEB-INF/web.xmlPK" fullword ascii /* Goodware String - occured 1 times */
		$s4 = "META-INF/MANIFEST.MF" fullword ascii /* Goodware String - occured 12 times */

Detection condition:
uint16(0) == 0x4b50 and filesize < 2KB and all of them

Full rule:
rule jsp_cmd {
	meta:
		description = "Laudanum Injector Tools - file cmd.war"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "55e4c3dc00cfab7ac16e7cfb53c11b0c01c16d3d"
		id = "74db62b8-82d5-5a34-aa72-2f85053715a4"
	strings:
		$s0 = "cmd.jsp}" fullword ascii
		$s1 = "cmd.jspPK" fullword ascii
		$s2 = "WEB-INF/web.xml" fullword ascii /* Goodware String - occured 1 times */
		$s3 = "WEB-INF/web.xmlPK" fullword ascii /* Goodware String - occured 1 times */
		$s4 = "META-INF/MANIFEST.MF" fullword ascii /* Goodware String - occured 12 times */
	condition:
		uint16(0) == 0x4b50 and filesize < 2KB and all of them
}
YARA Detection Rule: laudanum
Repository: Neo23x0/signature-base
Detects: Laudanum Injector Tools - file laudanum.php
Author: Florian Roth (Nextron Systems)
Reference: http://laudanum.inguardians.com/

Pattern signatures:
$s1 = "public function __activate()" fullword ascii
		$s2 = "register_activation_hook(__FILE__, array('WP_Laudanum', 'activate'));" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
filesize < 5KB and all of them

Full rule:
rule laudanum {
	meta:
		description = "Laudanum Injector Tools - file laudanum.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "fd498c8b195967db01f68776ff5e36a06c9dfbfe"
		id = "8c836aba-3644-5914-a3ff-937d0a6cd378"
	strings:
		$s1 = "public function __activate()" fullword ascii
		$s2 = "register_activation_hook(__FILE__, array('WP_Laudanum', 'activate'));" fullword ascii /* PEStudio Blacklist: strings */
	condition:
		filesize < 5KB and all of them
}
YARA Detection Rule: php_file
Repository: Neo23x0/signature-base
Detects: Laudanum Injector Tools - file file.php
Author: Florian Roth (Nextron Systems)
Reference: http://laudanum.inguardians.com/

Pattern signatures:
$s1 = "$allowedIPs =" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "<a href=\"<?php echo $_SERVER['PHP_SELF']  ?>\">Home</a><br/>" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "$dir  = isset($_GET[\"dir\"])  ? $_GET[\"dir\"]  : \".\";" fullword ascii
		$s4 = "$curdir .= substr($curdir, -1) != \"/\" ? \"/\" : \"\";" fullword ascii

Detection condition:
filesize < 10KB and all of them

Full rule:
rule php_file {
	meta:
		description = "Laudanum Injector Tools - file file.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "7421d33e8007c92c8642a36cba7351c7f95a4335"
		id = "68[PII_REDACTED]-5e42-b8a0-67ecaf83cdc0"
	strings:
		$s1 = "$allowedIPs =" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "<a href=\"<?php echo $_SERVER['PHP_SELF']  ?>\">Home</a><br/>" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "$dir  = isset($_GET[\"dir\"])  ? $_GET[\"dir\"]  : \".\";" fullword ascii
		$s4 = "$curdir .= substr($curdir, -1) != \"/\" ? \"/\" : \"\";" fullword ascii
	condition:
		filesize < 10KB and all of them
}
YARA Detection Rule: warfiles_cmd
Repository: Neo23x0/signature-base
Detects: Laudanum Injector Tools - file cmd.jsp
Author: Florian Roth (Nextron Systems)
Reference: http://laudanum.inguardians.com/

Pattern signatures:
$s1 = "Process p = Runtime.getRuntime().exec(request.getParameter(\"cmd\"));" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "out.println(\"Command: \" + request.getParameter(\"cmd\") + \"<BR>\");" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "<FORM METHOD=\"GET\" NAME=\"myform\" ACTION=\"\">" fullword ascii
		$s4 = "String disr = dis.readLine();" fullword ascii

Detection condition:
filesize < 2KB and all of them

Full rule:
rule warfiles_cmd {
	meta:
		description = "Laudanum Injector Tools - file cmd.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "3ae3d837e7b362de738cf7fad78eded0dccf601f"
		id = "f974255b-cfbe-57b0-af1f-eddb7f12f5ed"
	strings:
		$s1 = "Process p = Runtime.getRuntime().exec(request.getParameter(\"cmd\"));" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "out.println(\"Command: \" + request.getParameter(\"cmd\") + \"<BR>\");" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "<FORM METHOD=\"GET\" NAME=\"myform\" ACTION=\"\">" fullword ascii
		$s4 = "String disr = dis.readLine();" fullword ascii
	condition:
		filesize < 2KB and all of them
}
YARA Detection Rule: asp_dns
Repository: Neo23x0/signature-base
Detects: Laudanum Injector Tools - file dns.asp
Author: Florian Roth (Nextron Systems)
Reference: http://laudanum.inguardians.com/

Pattern signatures:
$s1 = "command = \"nslookup -type=\" & qtype & \" \" & query " fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "Set objCmd = objWShell.Exec(command)" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "Response.Write command & \"<br>\"" fullword ascii /* PEStudio Blacklist: strings */
		$s4 = "<form name=\"dns\" method=\"POST\">" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
filesize < 21KB and all of them

Full rule:
rule asp_dns {
	meta:
		description = "Laudanum Injector Tools - file dns.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "5532154dd67800d33dace01103e9b2c4f3d01d51"
		id = "b0e30ca0-7163-5731-98c5-5a1893b8ea80"
	strings:
		$s1 = "command = \"nslookup -type=\" & qtype & \" \" & query " fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "Set objCmd = objWShell.Exec(command)" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "Response.Write command & \"<br>\"" fullword ascii /* PEStudio Blacklist: strings */
		$s4 = "<form name=\"dns\" method=\"POST\">" fullword ascii /* PEStudio Blacklist: strings */
	condition:
		filesize < 21KB and all of them
}
YARA Detection Rule: php_reverse_shell_2
Repository: Neo23x0/signature-base
Detects: Laudanum Injector Tools - file php-reverse-shell.php
Author: Florian Roth (Nextron Systems)
Reference: http://laudanum.inguardians.com/

Pattern signatures:
$s1 = "$process = proc_open($shell, $descriptorspec, $pipes);" fullword ascii /* PEStudio Blacklist: strings */
		$s7 = "$shell = 'uname -a; w; id; /bin/sh -i';" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
filesize < 10KB and all of them

Full rule:
rule php_reverse_shell_2 {
	meta:
		description = "Laudanum Injector Tools - file php-reverse-shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "025db3c[PII_REDACTED]f0606d93d155c7eb5049c42"
		id = "f10cc33e-0cb6-5d08-af1f-5ef76368de9d"
	strings:
		$s1 = "$process = proc_open($shell, $descriptorspec, $pipes);" fullword ascii /* PEStudio Blacklist: strings */
		$s7 = "$shell = 'uname -a; w; id; /bin/sh -i';" fullword ascii /* PEStudio Blacklist: strings */
	condition:
		filesize < 10KB and all of them
}
YARA Detection Rule: Laudanum_Tools_Generic
Repository: Neo23x0/signature-base
Detects: Laudanum Injector Tools
Author: Florian Roth (Nextron Systems)
Reference: http://laudanum.inguardians.com/

Pattern signatures:
$s1 = "***  laudanum@secureideas.net" fullword ascii
		$s2 = "*** Laudanum Project" fullword ascii

Detection condition:
filesize < 60KB and all of them

Full rule:
rule Laudanum_Tools_Generic {
	meta:
		description = "Laudanum Injector Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		super_rule = 1
		hash0 = "076aa781a004ecb2bf545357fd36dcbafdd68b1a"
		hash1 = "885e1783b07c73e7d47d3283be303c9719419b92"
		hash2 = "01d5d16d876c55d77e094ce2b9c237de43b21a16"
		hash3 = "7421d33e8007c92c8642a36cba7351c7f95a4335"
		hash4 = "f49291aef9165ee4904d2d8c3cf5a6515ca0794f"
		hash5 = "c0dee56ee68719d5ec39e773621ffe40b144fda5"
		hash6 = "f32b9c2cc3a61fa326e9caebce28ef94a7a00c9a"
		hash7 = "dc5c03a21267d024ef0f5ab96a34e3f6423dfcd6"
		hash8 = "fd498c8b195967db01f68776ff5e36a06c9dfbfe"
		hash9 = "b50ae35fcf767466f6ca25984cc008b7629676b8"
		hash10 = "5570d10244d90ef53b74e2ac287fc657e38200f0"
		hash11 = "42bcb491a11b4703c125daf1747cf2a40a1b36f3"
		hash12 = "83e4eaaa2cf6898d7f83ab80158b64b1d48096f4"
		hash13 = "dec7ea322898690a7f91db9377f035ad7072b8d7"
		hash14 = "a2272b8a4221c6cc373915f0cc555fe55d65ac4d"
		hash15 = "588739b9e4ef2dbb0b4cf630b73295d8134cc801"
		hash16 = "43320dc23fb2ed26b882512e7c0bfdc64e2c1849"
		id = "15738788-5f34-54d0-92fe-f7024c998a54"
	strings:
		$s1 = "***  laudanum@secureideas.net" fullword ascii
		$s2 = "*** Laudanum Project" fullword ascii
	condition:
		filesize < 60KB and all of them
}
YARA Detection Rule: LOG_EXPL_SharePoint_CVE_2023_29357_Sep23_1
Repository: Neo23x0/signature-base
Detects: Detects log entries that could indicate a successful exploitation of CVE-2023-29357 on Microsoft SharePoint servers with the published Python POC
Author: Florian Roth (with help from @LuemmelSec)
Reference: https://twitter.com/Gi7w0rm/status/[PII_REDACTED]04591953?s=20

Pattern signatures:
/* 
         references:
         https://x.com/TH3C0DEX/status/[PII_REDACTED]96925048?s=20 
         https://x.com/theluemmel/status/[PII_REDACTED]27311360?s=20 (plus private chat)
      */
      $xr1 = /GET [a-z\.\/_]{0,40}\/web\/(siteusers|currentuser) - (80|443) .{10,200} (python-requests\/[0-9\.]{3,8}|-) [^ ]{1,160} [^4]0[0-9] /

Detection condition:
$xr1

Full rule:
rule LOG_EXPL_SharePoint_CVE_2023_29357_Sep23_1 {
   meta:
      description = "Detects log entries that could indicate a successful exploitation of CVE-2023-29357 on Microsoft SharePoint servers with the published Python POC"
      author = "Florian Roth (with help from @LuemmelSec)"
      reference = "https://twitter.com/Gi7w0rm/status/[PII_REDACTED]04591953?s=20"
      date = "2023-09-28"
      modified = "2023-10-01"
      score = 70
      id = "9fa77216-c0d6-55e5-bbcc-adb9438ca456"
   strings:
      /* 
         references:
         https://x.com/TH3C0DEX/status/[PII_REDACTED]96925048?s=20 
         https://x.com/theluemmel/status/[PII_REDACTED]27311360?s=20 (plus private chat)
      */
      $xr1 = /GET [a-z\.\/_]{0,40}\/web\/(siteusers|currentuser) - (80|443) .{10,200} (python-requests\/[0-9\.]{3,8}|-) [^ ]{1,160} [^4]0[0-9] /
   condition:
      $xr1
}
YARA Detection Rule: HKTL_EXPL_POC_PY_SharePoint_CVE_2023_29357_Sep23_1
Repository: Neo23x0/signature-base
Detects: Detects a Python POC to exploit CVE-2023-29357 on Microsoft SharePoint servers
Author: Florian Roth
Reference: https://github.com/Chocapikk/CVE-2023-29357

Pattern signatures:
$x1 = "encoded_payload = base64.urlsafe_b64encode(json.dumps(payload).encode()).rstrip(b'=')"

Detection condition:
filesize < 30KB and $x1

Full rule:
rule HKTL_EXPL_POC_PY_SharePoint_CVE_2023_29357_Sep23_1 {
   meta:
      description = "Detects a Python POC to exploit CVE-2023-29357 on Microsoft SharePoint servers"
      author = "Florian Roth"
      reference = "https://github.com/Chocapikk/CVE-2023-29357"
      date = "2023-10-01"
      modified = "2023-10-01"
      score = 80
      id = "2be524ab-f360-56b8-9ce3-e15036855c67"
   strings:
      $x1 = "encoded_payload = base64.urlsafe_b64encode(json.dumps(payload).encode()).rstrip(b'=')"
   condition:
      filesize < 30KB and $x1
}
YARA Detection Rule: HKTL_EXPL_POC_NET_SharePoint_CVE_2023_29357_Sep23_1
Repository: Neo23x0/signature-base
Detects: Detects a C# POC to exploit CVE-2023-29357 on Microsoft SharePoint servers
Author: Florian Roth
Reference: https://github.com/LuemmelSec/CVE-2023-29357

Pattern signatures:
$x1 = "{f22d2de0-606b-4d16-98d5-421f3f1ba8bc}" ascii wide
      $x2 = "{F22D2DE0-606B-4D16-98D5-421F3F1BA8BC}" ascii wide

      $s1 = "Bearer"
      $s2 = "hashedprooftoken"
      $s3 = "/_api/web/"
      $s4 = "X-PROOF_TOKEN"
      $s5 = "00[PII_REDACTED]-0ff1-ce00[PII_REDACTED]00"
      $s6 = "IsSiteAdmin"

Detection condition:
uint16(0) == 0x5a4d
      and filesize < 800KB 
      and (
         1 of ($x*)
         or all of ($s*)
      )

Full rule:
rule HKTL_EXPL_POC_NET_SharePoint_CVE_2023_29357_Sep23_1 {
   meta:
      description = "Detects a C# POC to exploit CVE-2023-29357 on Microsoft SharePoint servers"
      author = "Florian Roth"
      reference = "https://github.com/LuemmelSec/CVE-2023-29357"
      date = "2023-10-01"
      score = 80
      id = "aa6aeb00-b162-538c-a670-cbff525dd8f1"
   strings:
      $x1 = "{f22d2de0-606b-4d16-98d5-421f3f1ba8bc}" ascii wide
      $x2 = "{F22D2DE0-606B-4D16-98D5-421F3F1BA8BC}" ascii wide

      $s1 = "Bearer"
      $s2 = "hashedprooftoken"
      $s3 = "/_api/web/"
      $s4 = "X-PROOF_TOKEN"
      $s5 = "00[PII_REDACTED]-0ff1-ce00[PII_REDACTED]00"
      $s6 = "IsSiteAdmin"
   condition:
      uint16(0) == 0x5a4d
      and filesize < 800KB 
      and (
         1 of ($x*)
         or all of ($s*)
      )
}
YARA Detection Rule: PowerShell_ISESteroids_Obfuscation
Repository: Neo23x0/signature-base
Detects: Detects PowerShell ISESteroids obfuscation
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/danielhbohannon/status/[PII_REDACTED]37844993

Pattern signatures:
$x1 = "/\\/===\\__" ascii
      $x2 = "${__/\\/==" ascii
      $x3 = "Catch { }" fullword ascii
      $x4 = "\\_/=} ${_" ascii

Detection condition:
2 of them

Full rule:
rule PowerShell_ISESteroids_Obfuscation {
   meta:
      description = "Detects PowerShell ISESteroids obfuscation"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/danielhbohannon/status/[PII_REDACTED]37844993"
      date = "2017-06-23"
      id = "d686c4de-28fd-5d77-91d4-dde5661b75cd"
   strings:
      $x1 = "/\\/===\\__" ascii
      $x2 = "${__/\\/==" ascii
      $x3 = "Catch { }" fullword ascii
      $x4 = "\\_/=} ${_" ascii
   condition:
      2 of them
}
YARA Detection Rule: SUSP_Obfuscted_PowerShell_Code
Repository: Neo23x0/signature-base
Detects: Detects obfuscated PowerShell Code
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/silv0123/status/[PII_REDACTED]84880640

Pattern signatures:
$s1 = "').Invoke(" ascii
      $s2 = "(\"{1}{0}\"" ascii
      $s3 = "{0}\" -f" ascii

Detection condition:
#s1 > 11 and #s2 > 10 and #s3 > 10

Full rule:
rule SUSP_Obfuscted_PowerShell_Code {
   meta:
      description = "Detects obfuscated PowerShell Code"
      date = "2018-12-13"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/silv0123/status/[PII_REDACTED]84880640"
      id = "e2d8fc9e-ce2b-5118-8305-0d5839561d4f"
   strings:
      $s1 = "').Invoke(" ascii
      $s2 = "(\"{1}{0}\"" ascii
      $s3 = "{0}\" -f" ascii
   condition:
      #s1 > 11 and #s2 > 10 and #s3 > 10
}
YARA Detection Rule: SUSP_PowerShell_Caret_Obfuscation_2
Repository: Neo23x0/signature-base
Detects: Detects powershell keyword obfuscated with carets
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$r1 = /p[\^]?o[\^]?w[\^]?e[\^]?r[\^]?s[\^]?h[\^]?e[\^]?l\^l/ ascii wide nocase fullword
      $r2 = /p\^o[\^]?w[\^]?e[\^]?r[\^]?s[\^]?h[\^]?e[\^]?l[\^]?l/ ascii wide nocase fullword

Detection condition:
1 of them

Full rule:
rule SUSP_PowerShell_Caret_Obfuscation_2 {
   meta:
      description = "Detects powershell keyword obfuscated with carets"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2019-07-20"
      id = "976e261a-029c-5703-835f-a235c5657471"
   strings:
      $r1 = /p[\^]?o[\^]?w[\^]?e[\^]?r[\^]?s[\^]?h[\^]?e[\^]?l\^l/ ascii wide nocase fullword
      $r2 = /p\^o[\^]?w[\^]?e[\^]?r[\^]?s[\^]?h[\^]?e[\^]?l[\^]?l/ ascii wide nocase fullword
   condition:
      1 of them
}
YARA Detection Rule: SUSP_OBFUSC_PowerShell_True_Jun20_1
Repository: Neo23x0/signature-base
Detects: Detects indicators often found in obfuscated PowerShell scripts. Note: This detection is based on common characteristics typically associated with the mentioned threats, must be considered a clue and does not conclusively prove maliciousness.
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/corneacristian/mimikatz-bypass/

Pattern signatures:
$ = "${t`rue}" ascii nocase
      $ = "${tr`ue}" ascii nocase
      $ = "${tru`e}" ascii nocase
      $ = "${t`ru`e}" ascii nocase
      $ = "${tr`u`e}" ascii nocase
      $ = "${t`r`ue}" ascii nocase
      $ = "${t`r`u`e}" ascii nocase

Detection condition:
filesize < 6000KB and 1 of them

Full rule:
rule SUSP_OBFUSC_PowerShell_True_Jun20_1 {
   meta:
      description = "Detects indicators often found in obfuscated PowerShell scripts. Note: This detection is based on common characteristics typically associated with the mentioned threats, must be considered a clue and does not conclusively prove maliciousness."
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/corneacristian/mimikatz-bypass/"
      date = "2020-06-27"
      score = 75
      id = "e9bb870b-ad72-57d3-beff-2f84a81490eb"
   strings:
      $ = "${t`rue}" ascii nocase
      $ = "${tr`ue}" ascii nocase
      $ = "${tru`e}" ascii nocase
      $ = "${t`ru`e}" ascii nocase
      $ = "${tr`u`e}" ascii nocase
      $ = "${t`r`ue}" ascii nocase
      $ = "${t`r`u`e}" ascii nocase
   condition:
      filesize < 6000KB and 1 of them
}
YARA Detection Rule: SUSP_NET_Msil_Suspicious_Use_StrReverse
Repository: Neo23x0/signature-base
Detects: Detects mixed use of Microsoft.CSharp and VisualBasic to use StrReverse
Author: dr4k0nia, modified by Florian Roth
Reference: https://github.com/dr4k0nia/yara-rules

Pattern signatures:
$a1 = ", PublicKeyToken="
      $a2 = ".NETFramework,Version="

      $csharp = "Microsoft.CSharp"
      $vbnet = "Microsoft.VisualBasic"
      $strreverse = "StrReverse"

Detection condition:
uint16(0) == 0x5a4d
      and filesize < 50MB
      and all of ($a*)
      and $csharp
      and $vbnet
      and $strreverse

Full rule:
rule SUSP_NET_Msil_Suspicious_Use_StrReverse {
   meta:
      /* 
         This combination of imports and usage of StrReverse appears often
         in .NET crypters and malware trying to evade static string analysis
      */
      description = "Detects mixed use of Microsoft.CSharp and VisualBasic to use StrReverse"
      author = "dr4k0nia, modified by Florian Roth"
      reference = "https://github.com/dr4k0nia/yara-rules"
      version = "1.1"
      date = "01/31/2023"
      modified = "02/22/2023"
      score = 70
      hash = "02ce0980427dea835fc9d9eed025dd26672bf2c15f0b10486ff8107ce3950701"
      id = "830dec40-4412-59c1-8b4d-a237f14acd30"
   strings:
      $a1 = ", PublicKeyToken="
      $a2 = ".NETFramework,Version="

      $csharp = "Microsoft.CSharp"
      $vbnet = "Microsoft.VisualBasic"
      $strreverse = "StrReverse"
   condition:
      uint16(0) == 0x5a4d
      and filesize < 50MB
      and all of ($a*)
      and $csharp
      and $vbnet
      and $strreverse
}