deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: HKTL_Meterpreter_inMemory
Repository: Neo23x0/signature-base
Detects: Detects Meterpreter in-memory
Author: netbiosX, Florian Roth
Reference: https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/

Pattern signatures:
$sxc1 = { 6D 65 74 73 72 76 2E 64 6C 6C 00 00 52 65 66 6C 
               65 63 74 69 76 65 4C 6F 61 64 65 72 }
      $sxs1 = "metsrv.x64.dll" ascii fullword
      $ss1 = "WS2_32.dll" ascii fullword
      $ss2 = "ReflectiveLoader" ascii fullword

      $fp1 = "SentinelOne" ascii wide
      $fp2 = "fortiESNAC" ascii wide
      $fp3 = "PSNMVHookMS" ascii wide

Detection condition:
( 1 of ($sx*) or 2 of ($s*) )
      and not 1 of ($fp*)

Full rule:
rule HKTL_Meterpreter_inMemory {
   meta:
      description = "Detects Meterpreter in-memory"
      author = "netbiosX, Florian Roth"
      reference = "https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/"
      date = "2020-06-29"
      modified = "2023-04-21"
      score = 85
      id = "29c3bb7e-4da8-5924-ada7-2f28d9352009"
   strings: 
      $sxc1 = { 6D 65 74 73 72 76 2E 64 6C 6C 00 00 52 65 66 6C 
               65 63 74 69 76 65 4C 6F 61 64 65 72 }
      $sxs1 = "metsrv.x64.dll" ascii fullword
      $ss1 = "WS2_32.dll" ascii fullword
      $ss2 = "ReflectiveLoader" ascii fullword

      $fp1 = "SentinelOne" ascii wide
      $fp2 = "fortiESNAC" ascii wide
      $fp3 = "PSNMVHookMS" ascii wide
   condition: 
      ( 1 of ($sx*) or 2 of ($s*) )
      and not 1 of ($fp*)
}
YARA Detection Rule: SUSP_Doc_WindowsInstaller_Call_Feb22_1
Repository: Neo23x0/signature-base
Detects: Triggers on docfiles executing windows installer. Used for deploying ThinBasic scripts.
Author: Nils Kuhnert
Reference: https://inquest.net/blog/2022/02/24/dangerously-thinbasic

Pattern signatures:
$ = "WindowsInstaller.Installer$"
        $ = "CreateObject"
        $ = "InstallProduct"

Detection condition:
uint32be(0) == 0xd0cf11e0 and all of them

Full rule:
rule SUSP_Doc_WindowsInstaller_Call_Feb22_1 {
    meta:
        author = "Nils Kuhnert"
        date = "2022-02-26"
        description = "Triggers on docfiles executing windows installer. Used for deploying ThinBasic scripts."
        tlp = "white"
        reference = "https://inquest.net/blog/2022/02/24/dangerously-thinbasic"
        reference2 = "https://twitter.com/threatinsight/status/[PII_REDACTED]44133895"
        id = "8f2e8f91-74e0-5574-9c0a-1479d6114212"
    strings:
        $ = "WindowsInstaller.Installer$"
        $ = "CreateObject"
        $ = "InstallProduct"
    condition:
        uint32be(0) == 0xd0cf11e0 and all of them
}
YARA Detection Rule: EXPL_LOG_ProxyNotShell_OWASSRF_PowerShell_Proxy_Log_Dec22_1
Repository: Neo23x0/signature-base
Detects: Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082
Author: Florian Roth (Nextron Systems)
Reference: https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/

Pattern signatures:
$s1 = "/owa/mastermailbox%40outlook.com/powershell" ascii wide

      $sa1 = " 200 " ascii wide
      $sa2 = " POST " ascii wide

      // based on filters found in CrowdStrikes script https://github.com/CrowdStrike/OWASSRF/blob/main/Rps_Http-IOC.ps1
      $fp1 = "ClientInfo" ascii wide fullword
      $fp2 = "Microsoft WinRM Client" ascii wide fullword
      $fp3 = "Exchange BackEnd Probes" ascii wide fullword

Detection condition:
all of ($s*) and not 1 of ($fp*)

Full rule:
rule EXPL_LOG_ProxyNotShell_OWASSRF_PowerShell_Proxy_Log_Dec22_1 {
   meta:
      description = "Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
      date = "2022-12-22"
      score = 70
      id = "a61f6582-474f-5b6f-b8f5-329c0bcc4017"
   strings:
      $s1 = "/owa/mastermailbox%40outlook.com/powershell" ascii wide

      $sa1 = " 200 " ascii wide
      $sa2 = " POST " ascii wide

      // based on filters found in CrowdStrikes script https://github.com/CrowdStrike/OWASSRF/blob/main/Rps_Http-IOC.ps1
      $fp1 = "ClientInfo" ascii wide fullword
      $fp2 = "Microsoft WinRM Client" ascii wide fullword
      $fp3 = "Exchange BackEnd Probes" ascii wide fullword
   condition:
      all of ($s*) and not 1 of ($fp*)
}
YARA Detection Rule: EXPL_LOG_ProxyNotShell_OWASSRF_PowerShell_Proxy_Log_Dec22_2
Repository: Neo23x0/signature-base
Detects: Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082
Author: Florian Roth (Nextron Systems)
Reference: https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/

Pattern signatures:
$sr1 = / \/owa\/[^\/\s]{1,30}(%40|@)[^\/\s\.]{1,30}\.[^\/\s]{2,3}\/powershell / ascii wide

      $sa1 = " 200 " ascii wide
      $sa2 = " POST " ascii wide

      // based on filters found in CrowdStrikes script https://github.com/CrowdStrike/OWASSRF/blob/main/Rps_Http-IOC.ps1
      $fp1 = "ClientInfo" ascii wide fullword
      $fp2 = "Microsoft WinRM Client" ascii wide fullword
      $fp3 = "Exchange BackEnd Probes" ascii wide fullword

Detection condition:
all of ($s*)
      and not 1 of ($fp*)

Full rule:
rule EXPL_LOG_ProxyNotShell_OWASSRF_PowerShell_Proxy_Log_Dec22_2 {
   meta:
      description = "Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
      date = "2022-12-22"
      score = 60
      id = "85722997-fd28-51cf-817e-7a314e284b0b"
   strings:
      $sr1 = / \/owa\/[^\/\s]{1,30}(%40|@)[^\/\s\.]{1,30}\.[^\/\s]{2,3}\/powershell / ascii wide

      $sa1 = " 200 " ascii wide
      $sa2 = " POST " ascii wide

      // based on filters found in CrowdStrikes script https://github.com/CrowdStrike/OWASSRF/blob/main/Rps_Http-IOC.ps1
      $fp1 = "ClientInfo" ascii wide fullword
      $fp2 = "Microsoft WinRM Client" ascii wide fullword
      $fp3 = "Exchange BackEnd Probes" ascii wide fullword
   condition:
      all of ($s*)
      and not 1 of ($fp*)
}
YARA Detection Rule: EXPL_LOG_ProxyNotShell_OWASSRF_PowerShell_Proxy_Log_Dec22_3
Repository: Neo23x0/signature-base
Detects: Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082
Author: Florian Roth (Nextron Systems)
Reference: https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/

Pattern signatures:
$sa1 = " POST /powershell - 444 " ascii wide
      $sa2 = " POST /Powershell - 444 " ascii wide
      $sb1 = " - 200 0 0 2" ascii wide

      // based on filters found in CrowdStrikes script https://github.com/CrowdStrike/OWASSRF/blob/main/Rps_Http-IOC.ps1
      $fp1 = "ClientInfo" ascii wide fullword
      $fp2 = "Microsoft WinRM Client" ascii wide fullword
      $fp3 = "Exchange BackEnd Probes" ascii wide fullword

Detection condition:
1 of ($sa*) and $sb1 and not 1 of ($fp*)

Full rule:
rule EXPL_LOG_ProxyNotShell_OWASSRF_PowerShell_Proxy_Log_Dec22_3 {
   meta:
      description = "Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
      date = "2022-12-22"
      score = 60
      id = "76dd786e-daaa-5cd9-8e3e-50d9eab7f9d2"
   strings:
      $sa1 = " POST /powershell - 444 " ascii wide
      $sa2 = " POST /Powershell - 444 " ascii wide
      $sb1 = " - 200 0 0 2" ascii wide

      // based on filters found in CrowdStrikes script https://github.com/CrowdStrike/OWASSRF/blob/main/Rps_Http-IOC.ps1
      $fp1 = "ClientInfo" ascii wide fullword
      $fp2 = "Microsoft WinRM Client" ascii wide fullword
      $fp3 = "Exchange BackEnd Probes" ascii wide fullword
   condition:
      1 of ($sa*) and $sb1 and not 1 of ($fp*)
}
YARA Detection Rule: EXPL_LOG_ProxyNotShell_PowerShell_Proxy_Log_Dec22_1
Repository: Neo23x0/signature-base
Detects: Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082
Author: Florian Roth (Nextron Systems)
Reference: https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/

Pattern signatures:
$re1 = /,\/[Pp][Oo][Ww][Ee][Rr][Ss][Hh][Ee][Ll][Ll][^\n]{0,50},Kerberos,true,[^\n]{0,50},200,0,,,,[^\n]{0,2000};OnEndRequest\.End\.ContentType=application\/soap\+xml charset UTF-8;S:ServiceCommonMetadata\.HttpMethod=POST;/ ascii wide

      // based on filters found in CrowdStrikes script https://github.com/CrowdStrike/OWASSRF/blob/main/Rps_Http-IOC.ps1
      $fp1 = "ClientInfo" ascii wide fullword
      $fp2 = "Microsoft WinRM Client" ascii wide fullword
      $fp3 = "Exchange BackEnd Probes" ascii wide fullword

Detection condition:
$re1 and not 1 of ($fp*)

Full rule:
rule EXPL_LOG_ProxyNotShell_PowerShell_Proxy_Log_Dec22_1 {
   meta:
      description = "Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
      date = "2022-12-22"
      modified = "2023-01-26"
      score = 70
      id = "5af3ae70-8897-593f-a413-82ca1d1ba961"
   strings:
      $re1 = /,\/[Pp][Oo][Ww][Ee][Rr][Ss][Hh][Ee][Ll][Ll][^\n]{0,50},Kerberos,true,[^\n]{0,50},200,0,,,,[^\n]{0,2000};OnEndRequest\.End\.ContentType=application\/soap\+xml charset UTF-8;S:ServiceCommonMetadata\.HttpMethod=POST;/ ascii wide

      // based on filters found in CrowdStrikes script https://github.com/CrowdStrike/OWASSRF/blob/main/Rps_Http-IOC.ps1
      $fp1 = "ClientInfo" ascii wide fullword
      $fp2 = "Microsoft WinRM Client" ascii wide fullword
      $fp3 = "Exchange BackEnd Probes" ascii wide fullword
   condition:
      $re1 and not 1 of ($fp*)
}
YARA Detection Rule: Destructive_Ransomware_Gen1
Repository: Neo23x0/signature-base
Detects: Detects destructive malware
Author: Florian Roth (Nextron Systems)
Reference: http://blog.talosintelligence.com/2018/02/olympic-destroyer.html

Pattern signatures:
$x1 = "/set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no" fullword wide
      $x2 = "delete shadows /all /quiet" fullword wide
      $x3 = "delete catalog -quiet" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and 1 of them

Full rule:
rule Destructive_Ransomware_Gen1 {
   meta:
      description = "Detects destructive malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
      date = "2018-02-12"
      hash1 = "ae9a4e244a9b3c77d489dee8aeaf35a7c3ba31b210e76d81ef2e91790f052c85"
      id = "3a7ce55e-fb28-577b-91bb-fe02d7b3d73c"
   strings:
      $x1 = "/set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no" fullword wide
      $x2 = "delete shadows /all /quiet" fullword wide
      $x3 = "delete catalog -quiet" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 100KB and 1 of them
}
YARA Detection Rule: OlympicDestroyer_Gen2
Repository: Neo23x0/signature-base
Detects: Detects Olympic Destroyer malware
Author: Florian Roth (Nextron Systems)
Reference: http://blog.talosintelligence.com/2018/02/olympic-destroyer.html

Pattern signatures:
$x1 = "cmd.exe /c (ping 0.0.0.0 > nul) && if exist %programdata%\\evtchk.txt" fullword wide
      $x2 = "cmd.exe /c (echo strPath = Wscript.ScriptFullName & echo.Set FSO = CreateObject^(\"Scripting.FileSystemObject\"^)" wide
      $x3 = "del %programdata%\\evtchk.txt" fullword wide
      $x4 = "Pyeongchang2018.com\\svc_all_swd_installc" fullword ascii

      $s1 = "<STARTCRED>" fullword wide
      $s2 = "SELECT ds_cn FROM ds_computer" fullword wide
      $s3 = "\\system32\\notepad.exe" wide
      $s4 = "%s \\\\%s -u \"%s\" -p \"%s\" -accepteula -d %s %s \"%s\"" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 5000KB and (
         pe.imphash() == "fd7200dcd5c0d9d4d277a26d951210aa" or
         pe.imphash() == "975087e9286238a80895b195efb3968d" or
         pe.imphash() == "da1c2d7acfe54df797bfb1f470257bc3" or
         1 of ($x*) or
         3 of them
      )

Full rule:
rule OlympicDestroyer_Gen2 {
   meta:
      description = "Detects Olympic Destroyer malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
      date = "2018-02-12"
      hash1 = "d934cb8d0eadb93f8a57a9b8853c5db218d5db78c16a35f374e413884d915016"
      hash2 = "3e27b6b287f0b9f7e85bfe18901d961110ae969d58b44af15b1d75be749022c2"
      hash3 = "edb1ff2521fb4bf748111f92786d260d40407a2e8463dcd24bb09f908ee13eb9"
      hash4 = "28858cc6e05225f7d156d1c6a21ed11188777fa0a752cb7b56038d79a88627cc"
      id = "8d0cbb7b-6650-53ed-8d58-176f8b4af880"
   strings:
      $x1 = "cmd.exe /c (ping 0.0.0.0 > nul) && if exist %programdata%\\evtchk.txt" fullword wide
      $x2 = "cmd.exe /c (echo strPath = Wscript.ScriptFullName & echo.Set FSO = CreateObject^(\"Scripting.FileSystemObject\"^)" wide
      $x3 = "del %programdata%\\evtchk.txt" fullword wide
      $x4 = "Pyeongchang2018.com\\svc_all_swd_installc" fullword ascii

      $s1 = "<STARTCRED>" fullword wide
      $s2 = "SELECT ds_cn FROM ds_computer" fullword wide
      $s3 = "\\system32\\notepad.exe" wide
      $s4 = "%s \\\\%s -u \"%s\" -p \"%s\" -accepteula -d %s %s \"%s\"" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 5000KB and (
         pe.imphash() == "fd7200dcd5c0d9d4d277a26d951210aa" or
         pe.imphash() == "975087e9286238a80895b195efb3968d" or
         pe.imphash() == "da1c2d7acfe54df797bfb1f470257bc3" or
         1 of ($x*) or
         3 of them
      )
}
YARA Detection Rule: SUSP_NullSoftInst_Combo_Oct20_1
Repository: Neo23x0/signature-base
Detects: Detects suspicious NullSoft Installer combination with common Copyright strings
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/malwrhunterteam/status/[PII_REDACTED]77193472

Pattern signatures:
$a1 = "NullsoftInst" ascii 

      $b1 = "Microsoft Corporation" wide fullword
      $b2 = "Apache Software Foundation" ascii wide fullword
      $b3 = "Simon Tatham" wide fullword

      $fp1 = "nsisinstall" fullword ascii
      $fp2 = "\\REGISTRY\\MACHINE\\Software\\" wide
      $fp3 = "Apache Tomcat" wide fullword
      $fp4 = "Bot Framework Emulator" wide fullword
      $fp5 = "Firefox Helper" wide fullword
      $fp6 = "Paint.NET Setup" wide fullword
      $fp7 = "Microsoft .NET Services Installation Utility" wide fullword
      $fp8 = "License: MPL 2" wide

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 2000KB and
      $a1 and 1 of ($b*) and 
      not 1 of ($fp*)

Full rule:
rule SUSP_NullSoftInst_Combo_Oct20_1 {
   meta:
      description = "Detects suspicious NullSoft Installer combination with common Copyright strings"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/malwrhunterteam/status/[PII_REDACTED]77193472"
      date = "2020-10-06"
      score = 65
      hash1 = "686b5240e5e503528cc5ac8d764883413a260716dd290f114a60af873ee6a65f"
      hash2 = "93951379e57e4f159bb62fd7dd563d1ac2f3f23c80ba89f2da2e395b8a647dcf"
      hash3 = "a9ca1d6a981ccc8d8b144f337c259891a67eb6b85ee41b03699baacf4aae9a78"
      id = "380f30a6-df6b-50c6-bb2d-b8785564bbac"
   strings:
      $a1 = "NullsoftInst" ascii 

      $b1 = "Microsoft Corporation" wide fullword
      $b2 = "Apache Software Foundation" ascii wide fullword
      $b3 = "Simon Tatham" wide fullword

      $fp1 = "nsisinstall" fullword ascii
      $fp2 = "\\REGISTRY\\MACHINE\\Software\\" wide
      $fp3 = "Apache Tomcat" wide fullword
      $fp4 = "Bot Framework Emulator" wide fullword
      $fp5 = "Firefox Helper" wide fullword
      $fp6 = "Paint.NET Setup" wide fullword
      $fp7 = "Microsoft .NET Services Installation Utility" wide fullword
      $fp8 = "License: MPL 2" wide
   condition:
      uint16(0) == 0x5a4d and
      filesize < 2000KB and
      $a1 and 1 of ($b*) and 
      not 1 of ($fp*)
}
YARA Detection Rule: BKDR_XZUtil_Script_CVE_2024_3094_Mar24_1
Repository: Neo23x0/signature-base
Detects: Detects make file and script contents used by the backdoored XZ library (xzutil) CVE-2024-3094.
Author: Florian Roth
Reference: https://www.openwall.com/lists/oss-security/2024/03/29/4

Pattern signatures:
$x1 = "/bad-3-corrupt_lzma2.xz | tr " ascii
      $x2 = "/tests/files/good-large_compressed.lzma|eval $i|tail -c +31265|" ascii
      $x3 = "eval $zrKcKQ" ascii

Detection condition:
1 of them

Full rule:
rule BKDR_XZUtil_Script_CVE_2024_3094_Mar24_1 {
   meta:
      description = "Detects make file and script contents used by the backdoored XZ library (xzutil) CVE-2024-3094."
      author = "Florian Roth"
      reference = "https://www.openwall.com/lists/oss-security/2024/03/29/4"
      date = "2024-03-30"
      score = 80
      hash = "d44d0425769fa2e0b6875e5ca25d45b251bbe98870c6b9bef34f7cea9f84c9c3"
      id = "6b62ffc2-d0a7-5810-97a3-c48f7fac300e"
   strings:
      $x1 = "/bad-3-corrupt_lzma2.xz | tr " ascii
      $x2 = "/tests/files/good-large_compressed.lzma|eval $i|tail -c +31265|" ascii
      $x3 = "eval $zrKcKQ" ascii
   condition:
      1 of them
}
YARA Detection Rule: BKDR_XZUtil_Binary_CVE_2024_3094_Mar24_1
Repository: Neo23x0/signature-base
Detects: Detects injected code used by the backdoored XZ library (xzutil) CVE-2024-3094.
Author: Florian Roth
Reference: https://www.openwall.com/lists/oss-security/2024/03/29/4

Pattern signatures:
$op1 = { 48 8d 7c 24 08 f3 ab 48 8d 44 24 08 48 89 d1 4c 89 c7 48 89 c2 e8 ?? ?? ?? ?? 89 c2 }
      $op2 = { 31 c0 49 89 ff b9 16 00 00 00 4d 89 c5 48 8d 7c 24 48 4d 89 ce f3 ab 48 8d 44 24 48 }
      $op3 = { 4d 8b 6c 24 08 45 8b 3c 24 4c 8b 63 10 89 85 78 f1 ff ff 31 c0 83 bd 78 f1 ff ff 00 f3 ab 79 07 }

      /* function signature from detect.sh provided by Vegard Nossum */
      $xc1 = { F3 0F 1E FA 55 48 89 F5 4C 89 CE 53 89 FB 81 E7 00 00 00 80 48 83 EC 28 48 89 54 24 18 48 89 4C 24 10 }

Detection condition:
uint16(0) == 0x457f
      and (
         all of ($op*)
         or $xc1
      )

Full rule:
rule BKDR_XZUtil_Binary_CVE_2024_3094_Mar24_1 {
   meta:
      description = "Detects injected code used by the backdoored XZ library (xzutil) CVE-2024-3094."
      author = "Florian Roth"
      reference = "https://www.openwall.com/lists/oss-security/2024/03/29/4"
      date = "2024-03-30"
      score = 75
      hash1 = "319feb5a9cddd81955d915b5632b4a5f8f9080281fb46e2f6d69d53f693c23ae"
      hash2 = "605861f833fc181c7cdcabd5577ddb8989bea332648a8f498b4eef89b8f85ad4"
      hash3 = "8fa641c454c3e0f76de73b7cc3446096b9c8b9d33d406d38b8ac76090b0344fd"
      hash4 = "b418bfd34aa246b2e7b5cb5d263a640e5d080810f767370c4d2c24662a274963"
      hash5 = "cbeef92e67bf41ca9c015557d81f39adaba67ca9fb[PII_REDACTED]999030b83537"
      hash6 = "5448850cdc3a7ae41ff53b433c2adbd0ff[PII_REDACTED]12ee63a40d2685db3049"
      id = "6ccdeb6d-67c4-5358-a76b-aef7f047c997"
   strings:
      $op1 = { 48 8d 7c 24 08 f3 ab 48 8d 44 24 08 48 89 d1 4c 89 c7 48 89 c2 e8 ?? ?? ?? ?? 89 c2 }
      $op2 = { 31 c0 49 89 ff b9 16 00 00 00 4d 89 c5 48 8d 7c 24 48 4d 89 ce f3 ab 48 8d 44 24 48 }
      $op3 = { 4d 8b 6c 24 08 45 8b 3c 24 4c 8b 63 10 89 85 78 f1 ff ff 31 c0 83 bd 78 f1 ff ff 00 f3 ab 79 07 }

      /* function signature from detect.sh provided by Vegard Nossum */
      $xc1 = { F3 0F 1E FA 55 48 89 F5 4C 89 CE 53 89 FB 81 E7 00 00 00 80 48 83 EC 28 48 89 54 24 18 48 89 4C 24 10 }
   condition:
      uint16(0) == 0x457f
      and (
         all of ($op*)
         or $xc1
      )
}
YARA Detection Rule: BKDR_XZUtil_KillSwitch_CVE_2024_3094_Mar24_1
Repository: Neo23x0/signature-base
Detects: Detects kill switch used by the backdoored XZ library (xzutil) CVE-2024-3094.
Author: Florian Roth
Reference: https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01?permalink_comment_id=5006558#gistcomment-5006558

Pattern signatures:
$x1 = "yolAbejyiejuvnup=Evjtgvsh5okmkAvj"

Detection condition:
$x1

Full rule:
rule BKDR_XZUtil_KillSwitch_CVE_2024_3094_Mar24_1 {
   meta:
      description = "Detects kill switch used by the backdoored XZ library (xzutil) CVE-2024-3094."
      author = "Florian Roth"
      reference = "https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01?permalink_comment_id=5006558#gistcomment-5006558"
      date = "2024-03-30"
      score = 85
      id = "0d28bec4-1d3a-5af0-9e9e-49486fcc62e1"
   strings:
      $x1 = "yolAbejyiejuvnup=Evjtgvsh5okmkAvj"
   condition:
      $x1
}
YARA Detection Rule: SUSP_OBFUSC_SH_Indicators_Mar24_1
Repository: Neo23x0/signature-base
Detects: Detects characteristics found in obfuscated script (used in the backdoored XZ package, but could match on others, too)
Author: Florian Roth
Reference: https://www.openwall.com/lists/oss-security/2024/03/29/4/1

Pattern signatures:
$s1 = "eval $"

Detection condition:
uint8(1) == 0x3d // an equal sign at byte 2 ; means that the variable is only 1 character long
      and $s1 in (filesize-20..filesize) // eval at the very end of the file

Full rule:
rule SUSP_OBFUSC_SH_Indicators_Mar24_1 {
   meta:
      description = "Detects characteristics found in obfuscated script (used in the backdoored XZ package, but could match on others, too)"
      author = "Florian Roth"
      reference = "https://www.openwall.com/lists/oss-security/2024/03/29/4/1"
      date = "2024-04-06"
      score = 60
      id = "f9fcc326-75d6-5a5a-a8b5-7de15a11448e"
   strings:
      $s1 = "eval $"
   condition:
      uint8(1) == 0x3d // an equal sign at byte 2 ; means that the variable is only 1 character long
      and $s1 in (filesize-20..filesize) // eval at the very end of the file
}
YARA Detection Rule: OpCloudHopper_Malware_1
Repository: Neo23x0/signature-base
Detects: Detects malware from Operation Cloud Hopper
Author: Florian Roth (Nextron Systems)
Reference: https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html

Pattern signatures:
$s1 = "zok]\\\\\\ZZYYY666564444" fullword ascii
      $s2 = "z{[ZZYUKKKIIGGGGGGGGGGGGG" fullword ascii
      $s3 = "EEECEEC" fullword ascii
      $s4 = "IIEFEE" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and all of them )

Full rule:
rule OpCloudHopper_Malware_1 {
   meta:
      description = "Detects malware from Operation Cloud Hopper"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
      date = "2017-04-03"
      hash1 = "27876dc5e6f746ff6003450eeea5e98de5d96cbcba9e4694dad94ca3e9fb1ddc"
      id = "28ca64ac-beee-51d9-96d4-a1f6d52823ec"
   strings:
      $s1 = "zok]\\\\\\ZZYYY666564444" fullword ascii
      $s2 = "z{[ZZYUKKKIIGGGGGGGGGGGGG" fullword ascii
      $s3 = "EEECEEC" fullword ascii
      $s4 = "IIEFEE" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
}