deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT_Thrip_Sample_Jun18_11
Repository: Neo23x0/signature-base
Detects: Detects sample found in Thrip report by Symantec 
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets 

Pattern signatures:
$s1 = "\\AppData\\Local\\Temp\\dw20.EXE" ascii
      $s2 = "C:\\Windows\\system32\\sysprep\\cryptbase.dll" fullword ascii
      $s3 = "WFQNJMBWF" fullword ascii
      $s4 = "SQLWLWZSF" fullword ascii
      $s5 = "PFQUFQSBPP" fullword ascii
      $s6 = "WQZXQFPVOW" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB
      and ( pe.imphash() == "6eef[PII_REDACTED]f32d134ab3bf4bf194" or all of them )

Full rule:
rule APT_Thrip_Sample_Jun18_11 {
   meta:
      description = "Detects sample found in Thrip report by Symantec "
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
      date = "2018-06-21"
      hash1 = "590a6796b97469f8e6977832a63c[PII_REDACTED]f075a9651f7f1b4578e55bd8c8"
      id = "69476f7d-c436-5863-bf20-1d3e821974e6"
   strings:
      $s1 = "\\AppData\\Local\\Temp\\dw20.EXE" ascii
      $s2 = "C:\\Windows\\system32\\sysprep\\cryptbase.dll" fullword ascii
      $s3 = "WFQNJMBWF" fullword ascii
      $s4 = "SQLWLWZSF" fullword ascii
      $s5 = "PFQUFQSBPP" fullword ascii
      $s6 = "WQZXQFPVOW" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 100KB
      and ( pe.imphash() == "6eef[PII_REDACTED]f32d134ab3bf4bf194" or all of them )
}
YARA Detection Rule: APT_Thrip_Sample_Jun18_12
Repository: Neo23x0/signature-base
Detects: Detects sample found in Thrip report by Symantec 
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets 

Pattern signatures:
$s1 = "pGlobal->nOSType==64--%s\\cmd.exe %s" fullword ascii
      $s2 = "httpcom.log" fullword ascii
      $s3 = "\\CryptBase.dll" ascii
      $s4 = "gupdate.exe" fullword ascii
      $s5 = "wusa.exe" fullword ascii
      $s6 = " %s %s /quiet /extract:%s\\%s\\" ascii
      $s7 = "%s%s.dll.cab" fullword ascii
      $s8 = "/c %s\\%s\\%s%s %s" fullword ascii
      $s9 = "ReleaseEvildll" fullword ascii
      $s0 = "%s\\%s\\%s%s" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and 6 of them

Full rule:
rule APT_Thrip_Sample_Jun18_12 {
   meta:
      description = "Detects sample found in Thrip report by Symantec "
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
      date = "2018-06-21"
      hash1 = "33c01d3266fe6a70e8785efaf10208f869ae58a17fd9cdb2c6995324c9a01062"
      id = "b24b8042-b6a3-5af8-9fcf-6d042bdb9524"
   strings:
      $s1 = "pGlobal->nOSType==64--%s\\cmd.exe %s" fullword ascii
      $s2 = "httpcom.log" fullword ascii
      $s3 = "\\CryptBase.dll" ascii
      $s4 = "gupdate.exe" fullword ascii
      $s5 = "wusa.exe" fullword ascii
      $s6 = " %s %s /quiet /extract:%s\\%s\\" ascii
      $s7 = "%s%s.dll.cab" fullword ascii
      $s8 = "/c %s\\%s\\%s%s %s" fullword ascii
      $s9 = "ReleaseEvildll" fullword ascii
      $s0 = "%s\\%s\\%s%s" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 100KB and 6 of them
}
YARA Detection Rule: APT_Thrip_Sample_Jun18_13
Repository: Neo23x0/signature-base
Detects: Detects sample found in Thrip report by Symantec 
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets 

Pattern signatures:
$s1 = "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" fullword ascii
      $s2 = "<member><name>password</name>" fullword ascii
      $s3 = "<value><string>qqtorspy</string></value>" fullword ascii
      $s4 = "SOFTWARE\\QKitTORSPY" fullword wide
      $s5 = "ipecho.net" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB
      and ( pe.imphash() == "3dfad33b2fb66c083c99dc10341908b7" or 4 of them )

Full rule:
rule APT_Thrip_Sample_Jun18_13 {
   meta:
      description = "Detects sample found in Thrip report by Symantec "
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
      date = "2018-06-21"
      hash1 = "780620521c92aab3d592b3dc149cbf58751ea285cfdaa50510002b441796b312"
      id = "e6aec6f3-2024-5fb2-b37a-77a182684d32"
   strings:
      $s1 = "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" fullword ascii
      $s2 = "<member><name>password</name>" fullword ascii
      $s3 = "<value><string>qqtorspy</string></value>" fullword ascii
      $s4 = "SOFTWARE\\QKitTORSPY" fullword wide
      $s5 = "ipecho.net" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 500KB
      and ( pe.imphash() == "3dfad33b2fb66c083c99dc10341908b7" or 4 of them )
}
YARA Detection Rule: APT_Thrip_Sample_Jun18_14
Repository: Neo23x0/signature-base
Detects: Detects sample found in Thrip report by Symantec 
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets 

Pattern signatures:
$s1 = "%SystemRoot%\\System32\\svchost.exe -k " fullword ascii
      $s2 = "spdirs.dll" fullword ascii
      $s3 = "Provides storm installation services such as Publish, and Remove." fullword ascii
      $s4 = "RegSetValueEx(Svchost\\netsvcs)" fullword ascii
      $s5 = "Load %s Error" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and (
         ( pe.exports("InstallA") and pe.exports("InstallB") and pe.exports("InstallC") ) or
         all of them
      )

Full rule:
rule APT_Thrip_Sample_Jun18_14 {
   meta:
      description = "Detects sample found in Thrip report by Symantec "
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
      date = "2018-06-21"
      hash1 = "67dd44a8fbf6de94c4589cf08aa5757b785b26e49e29488e9748189e13d90fb3"
      id = "736e2700-cdcb-5165-b786-67edaef765b6"
   strings:
      $s1 = "%SystemRoot%\\System32\\svchost.exe -k " fullword ascii
      $s2 = "spdirs.dll" fullword ascii
      $s3 = "Provides storm installation services such as Publish, and Remove." fullword ascii
      $s4 = "RegSetValueEx(Svchost\\netsvcs)" fullword ascii
      $s5 = "Load %s Error" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and (
         ( pe.exports("InstallA") and pe.exports("InstallB") and pe.exports("InstallC") ) or
         all of them
      )
}
YARA Detection Rule: APT_Thrip_Sample_Jun18_15
Repository: Neo23x0/signature-base
Detects: Detects sample found in Thrip report by Symantec 
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets 

Pattern signatures:
$s1 = "%s\\cmd.exe /c %s" fullword ascii
      $s2 = "CryptBase.dll" fullword ascii
      $s3 = "gupdate.exe" fullword ascii
      $s4 = "wusa.exe" fullword ascii
      $s5 = " %s %s /quiet /extract:%s\\%s\\" ascii
      $s6 = "%s%s.dll.cab" fullword ascii
      $s7 = "%s\\%s\\%s%s %s" fullword ascii
      $s8 = "%s\\%s\\%s%s" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB
      and ( pe.imphash() == "f6ec70a295000ab0a753aa708e9439b4" or 6 of them )

Full rule:
rule APT_Thrip_Sample_Jun18_15 {
   meta:
      description = "Detects sample found in Thrip report by Symantec "
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
      date = "2018-06-21"
      hash1 = "231c569f11460a12b171f131c40a6f25d8416954b35c28ae184aba8a649d9786"
      id = "fd8aa404-4c12-5c8f-a952-a143da858b9b"
   strings:
      $s1 = "%s\\cmd.exe /c %s" fullword ascii
      $s2 = "CryptBase.dll" fullword ascii
      $s3 = "gupdate.exe" fullword ascii
      $s4 = "wusa.exe" fullword ascii
      $s5 = " %s %s /quiet /extract:%s\\%s\\" ascii
      $s6 = "%s%s.dll.cab" fullword ascii
      $s7 = "%s\\%s\\%s%s %s" fullword ascii
      $s8 = "%s\\%s\\%s%s" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB
      and ( pe.imphash() == "f6ec70a295000ab0a753aa708e9439b4" or 6 of them )
}
YARA Detection Rule: APT_Thrip_Sample_Jun18_16
Repository: Neo23x0/signature-base
Detects: Detects sample found in Thrip report by Symantec 
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets 

Pattern signatures:
$s1 = "[%d] Failed, %08X" fullword ascii
      $s2 = "woqunimalegebi" fullword ascii
      $s3 = "[%d] Offset can not fetched." fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB
      and ( all of them or pe.imphash() == "c6a4c95d868a3327a62c9c45f5e15bbf" )

Full rule:
rule APT_Thrip_Sample_Jun18_16 {
   meta:
      description = "Detects sample found in Thrip report by Symantec "
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
      date = "2018-06-21"
      hash1 = "2b1c1c6d82837dbbccd171a0413c1d761b1f7c3668a21c63ca06143e731f030e"
      id = "58be9a1b-2228-5d7a-97c9-198cacbe1a66"
   strings:
      $s1 = "[%d] Failed, %08X" fullword ascii
      $s2 = "woqunimalegebi" fullword ascii
      $s3 = "[%d] Offset can not fetched." fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB
      and ( all of them or pe.imphash() == "c6a4c95d868a3327a62c9c45f5e15bbf" )
}
YARA Detection Rule: APT_Thrip_Sample_Jun18_17
Repository: Neo23x0/signature-base
Detects: Detects sample found in Thrip report by Symantec 
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets 

Pattern signatures:
$x1 = "c:\\users\\administrator\\desktop\\code\\skeyman2\\" ascii
      $x2 = "\\SkeyMan2.pdb" ascii
      $x3 = "\\\\.\\Pnpkb" fullword ascii

      $s1 = "\\DosDevices\\Pnpkb" wide
      $s2 = "\\DosDevices\\PnpKb" wide
      $s3 = "\\Driver\\kbdhid" wide
      $s4 = "\\Device\\PnpKb" wide
      $s5 = "Microsoft  Windows Operating System" fullword wide
      $s6 = "hDevice == INVALID_HANDLE_VALUE" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 20KB and ( 1 of ($x*) and 1 of ($s*) )

Full rule:
rule APT_Thrip_Sample_Jun18_17 {
   meta:
      description = "Detects sample found in Thrip report by Symantec "
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
      date = "2018-06-21"
      hash1 = "05036de73c695f59adf818d3c669c48ce8626139d463b8a7e869d8155e5c0d85"
      hash2 = "08d8c610e1ec4a02364cb53ba44e3ca5d46e8a177a0ecd50a1ef7b5db252701d"
      hash3 = "14535607d9a7853f13e8bf63b629e3a19246ed9db6b4d2de2ca85ec7a7bee140"
      id = "e314a893-1ef5-5d5f-b056-af25765c0b70"
   strings:
      $x1 = "c:\\users\\administrator\\desktop\\code\\skeyman2\\" ascii
      $x2 = "\\SkeyMan2.pdb" ascii
      $x3 = "\\\\.\\Pnpkb" fullword ascii

      $s1 = "\\DosDevices\\Pnpkb" wide
      $s2 = "\\DosDevices\\PnpKb" wide
      $s3 = "\\Driver\\kbdhid" wide
      $s4 = "\\Device\\PnpKb" wide
      $s5 = "Microsoft  Windows Operating System" fullword wide
      $s6 = "hDevice == INVALID_HANDLE_VALUE" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 20KB and ( 1 of ($x*) and 1 of ($s*) )
}
YARA Detection Rule: APT_Thrip_Sample_Jun18_18
Repository: Neo23x0/signature-base
Detects: Detects sample found in Thrip report by Symantec 
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets 

Pattern signatures:
$s1 = "Windows 95/98/Me, Windows NT 4.0, Windows 2000/XP: IME PROCESS key" fullword ascii
      $s2 = "Windows 2000/XP: Either the angle bracket key or the backslash key on the RT 102-key keyboard" fullword ascii
      $s3 = "LoadLibraryA() failed in KbdGetProcAddressByName()" fullword ascii
      $s5 = "Unknown Virtual-Key Code" fullword ascii
      $s6 = "Computer Sleep key" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and all of them

Full rule:
rule APT_Thrip_Sample_Jun18_18 {
   meta:
      description = "Detects sample found in Thrip report by Symantec "
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
      date = "2018-06-21"
      hash1 = "33029f5364209e05481cfb2a4172c6dc157b0070f51c05dd34485b8e8da6e820"
      hash2 = "263c01a3b822722dc288a5ac138d953630d8c548a0bee080ae3979b7d364cecb"
      hash3 = "52d190a8d20b4845551b8765cbd12cfbe04cf23e6812e238e5a5023c34ee9b37"
      hash4 = "1f019e3c30a02b7b65f7984903af11d561d02b2666cc16463c274a2a0e62145d"
      hash5 = "43904ea071d4dce62a21c69b8d6efb47bcb24c467c6f6b3a6a6ed6cd2158bfe5"
      hash6 = "00d9da2b665070d674acdbb7c8f25a01086b7ca39d482d55f08717f7383ee26a"
      id = "20642526-5a4d-5dca-a6f5-29f19a9b5271"
   strings:
      $s1 = "Windows 95/98/Me, Windows NT 4.0, Windows 2000/XP: IME PROCESS key" fullword ascii
      $s2 = "Windows 2000/XP: Either the angle bracket key or the backslash key on the RT 102-key keyboard" fullword ascii
      $s3 = "LoadLibraryA() failed in KbdGetProcAddressByName()" fullword ascii
      $s5 = "Unknown Virtual-Key Code" fullword ascii
      $s6 = "Computer Sleep key" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and all of them
}
YARA Detection Rule: LOG_ProxyNotShell_POC_CVE_2022_41040_Nov22
Repository: Neo23x0/signature-base
Detects: Detects logs generated after a successful exploitation using the PoC code against CVE-2022-41040 and CVE-2022-41082 (aka ProxyNotShell) in Microsoft Exchange servers
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/testanull/ProxyNotShell-PoC

Pattern signatures:
$aa1 = " POST " ascii wide
      $aa2 = " GET " ascii wide

      $ab1 = " 200 " ascii wide

      $s01 = "/autodiscover.json x=a" ascii wide
      $s02 = "/autodiscover/admin@localhost/" ascii wide

Detection condition:
1 of ($aa*) and $ab1 and 1 of ($s*)

Full rule:
rule LOG_ProxyNotShell_POC_CVE_2022_41040_Nov22 {
   meta:
      description = "Detects logs generated after a successful exploitation using the PoC code against CVE-2022-41040 and CVE-2022-41082 (aka ProxyNotShell) in Microsoft Exchange servers"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/testanull/ProxyNotShell-PoC"
      date = "2022-11-17"
      score = 70
      id = "1e47d124-3103-5bf5-946f-b1bb69ff2c8e"
   strings:
      $aa1 = " POST " ascii wide
      $aa2 = " GET " ascii wide

      $ab1 = " 200 " ascii wide

      $s01 = "/autodiscover.json x=a" ascii wide
      $s02 = "/autodiscover/admin@localhost/" ascii wide
   condition:
      1 of ($aa*) and $ab1 and 1 of ($s*)
}
YARA Detection Rule: Tools_cmd
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file cmd.jSp
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "if(\"1752393\".equals(request.getParameter(\"Confpwd\"))){" fullword ascii
        $s1 = "java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter(\"Conn\"" ascii
        $s2 = "<%@ page import=\"java.io.*\" %>" fullword ascii
        $s3 = "out.print(\"Hi,Man 2015<br /><!--?Conf[CREDENTIAL_REDACTED]=ls-->\");" fullword ascii
        $s4 = "while((a=in.read(b))!=-1){" fullword ascii
        $s5 = "out.println(new String(b));" fullword ascii
        $s6 = "out.print(\"</pre>\");" fullword ascii
        $s7 = "out.print(\"<pre>\");" fullword ascii
        $s8 = "int a = -1;" fullword ascii
        $s9 = "byte[] b = new byte[2048];" fullword ascii

Detection condition:
filesize < 3KB and 7 of them

Full rule:
rule Tools_cmd {
    meta:
        description = "Chinese Hacktool Set - file cmd.jSp"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        reference = "http://tools.zjqhr.com/"
        date = "2015-06-13"
        hash = "02e37b95ef670336dc95331ec73dbb5a86f3ba2b"
        id = "27c3cb44-9351-52a2-8e14-afade14e3384"
    strings:
        $s0 = "if(\"1752393\".equals(request.getParameter(\"Confpwd\"))){" fullword ascii
        $s1 = "java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter(\"Conn\"" ascii
        $s2 = "<%@ page import=\"java.io.*\" %>" fullword ascii
        $s3 = "out.print(\"Hi,Man 2015<br /><!--?Conf[CREDENTIAL_REDACTED]=ls-->\");" fullword ascii
        $s4 = "while((a=in.read(b))!=-1){" fullword ascii
        $s5 = "out.println(new String(b));" fullword ascii
        $s6 = "out.print(\"</pre>\");" fullword ascii
        $s7 = "out.print(\"<pre>\");" fullword ascii
        $s8 = "int a = -1;" fullword ascii
        $s9 = "byte[] b = new byte[2048];" fullword ascii
    condition:
        filesize < 3KB and 7 of them
}
YARA Detection Rule: trigger_drop
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file trigger_drop.php
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "$_GET['returnto'] = 'database_properties.php';" fullword ascii
        $s1 = "echo('<meta http-equiv=\"refresh\" content=\"0;url=' . $_GET['returnto'] . '\">'" ascii
        $s2 = "@mssql_query('DROP TRIGGER" ascii
        $s3 = "if(empty($_GET['returnto']))" fullword ascii

Detection condition:
filesize < 5KB and all of them

Full rule:
rule trigger_drop {
    meta:
        description = "Chinese Hacktool Set - file trigger_drop.php"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        reference = "http://tools.zjqhr.com/"
        date = "2015-06-13"
        hash = "165dd2d82bf87285c8a53ad1ede6d61a90837ba4"
        id = "3b4f32ff-2de2-5689-869a-8a8f55e7fa0c"
    strings:
        $s0 = "$_GET['returnto'] = 'database_properties.php';" fullword ascii
        $s1 = "echo('<meta http-equiv=\"refresh\" content=\"0;url=' . $_GET['returnto'] . '\">'" ascii
        $s2 = "@mssql_query('DROP TRIGGER" ascii
        $s3 = "if(empty($_GET['returnto']))" fullword ascii
    condition:
        filesize < 5KB and all of them
}
YARA Detection Rule: InjectionParameters
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file InjectionParameters.vb
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "Public Shared ReadOnly Empty As New InjectionParameters(-1, \"\")" fullword ascii
        $s1 = "Public Class InjectionParameters" fullword ascii

Detection condition:
filesize < 13KB and all of them

Full rule:
rule InjectionParameters {
    meta:
        description = "Chinese Hacktool Set - file InjectionParameters.vb"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        reference = "http://tools.zjqhr.com/"
        date = "2015-06-13"
        hash = "4f11aa5b3660c45e527606ee33de001f4994e1ea"
        id = "a77bd0c6-8857-577f-831a-0fcf2537667e"
    strings:
        $s0 = "Public Shared ReadOnly Empty As New InjectionParameters(-1, \"\")" fullword ascii
        $s1 = "Public Class InjectionParameters" fullword ascii
    condition:
        filesize < 13KB and all of them
}
YARA Detection Rule: users_list
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file users_list.php
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "<a href=\"users_create.php\">Create User</a>" fullword ascii
        $s7 = "$skiplist = array('##MS_AgentSigningCertificate##','NT AUTHORITY\\NETWORK SERVIC" ascii
        $s11 = "&nbsp;<b>Default DB</b>&nbsp;" fullword ascii

Detection condition:
filesize < 12KB and all of them

Full rule:
rule users_list {
    meta:
        description = "Chinese Hacktool Set - file users_list.php"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        reference = "http://tools.zjqhr.com/"
        date = "2015-06-13"
        hash = "6fba1a1a607198ed232405ccbebf9543037a63ef"
        id = "2d90b593-6b65-502c-aeb0-8f2a3d65afd3"
    strings:
        $s0 = "<a href=\"users_create.php\">Create User</a>" fullword ascii
        $s7 = "$skiplist = array('##MS_AgentSigningCertificate##','NT AUTHORITY\\NETWORK SERVIC" ascii
        $s11 = "&nbsp;<b>Default DB</b>&nbsp;" fullword ascii
    condition:
        filesize < 12KB and all of them
}
YARA Detection Rule: trigger_modify
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file trigger_modify.php
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s1 = "<form name=\"form1\" method=\"post\" action=\"trigger_modify.php?trigger=<?php e" ascii
        $s2 = "$data_query = @mssql_query('sp_helptext \\'' . urldecode($_GET['trigger']) . '" ascii
        $s3 = "if($_POST['query'] != '')" fullword ascii
        $s4 = "$lines[] = 'I am unable to read this trigger.';" fullword ascii
        $s5 = "<b>Modify Trigger</b>" fullword ascii

Detection condition:
filesize < 15KB and all of them

Full rule:
rule trigger_modify {
    meta:
        description = "Chinese Hacktool Set - file trigger_modify.php"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        reference = "http://tools.zjqhr.com/"
        date = "2015-06-13"
        hash = "c93cd7a6c3f962381e9bf2b511db9b1639a22de0"
        id = "a7d65a9f-82de-554c-8f20-7560d2160041"
    strings:
        $s1 = "<form name=\"form1\" method=\"post\" action=\"trigger_modify.php?trigger=<?php e" ascii
        $s2 = "$data_query = @mssql_query('sp_helptext \\'' . urldecode($_GET['trigger']) . '" ascii
        $s3 = "if($_POST['query'] != '')" fullword ascii
        $s4 = "$lines[] = 'I am unable to read this trigger.';" fullword ascii
        $s5 = "<b>Modify Trigger</b>" fullword ascii
    condition:
        filesize < 15KB and all of them
}