deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: sig_238_token
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file token.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Logon.exe" fullword ascii
      $s1 = "Domain And User:" fullword ascii
      $s2 = "PID=Get Addr$(): One" fullword ascii
      $s3 = "Process " fullword ascii
      $s4 = "psapi.dllK" fullword ascii

Detection condition:
all of them

Full rule:
rule sig_238_token {
   meta:
      description = "Disclosed hacktool set (old stuff) - file token.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "c52bc6543d4281aa75a3e6e2da33cfb4b7c34b14"
      id = "9d0ac24b-2078-5455-8d9e-a642c71f7b2d"
   strings:
      $s0 = "Logon.exe" fullword ascii
      $s1 = "Domain And User:" fullword ascii
      $s2 = "PID=Get Addr$(): One" fullword ascii
      $s3 = "Process " fullword ascii
      $s4 = "psapi.dllK" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: sig_238_TELNET
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file TELNET.EXE from Windows ME
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "TELNET [host [port]]" fullword wide
      $s2 = "TELNET.EXE" fullword wide
      $s4 = "Microsoft(R) Windows(R) Millennium Operating System" fullword wide
      $s14 = "Software\\Microsoft\\Telnet" fullword wide

Detection condition:
all of them

Full rule:
rule sig_238_TELNET {
   meta:
      description = "Disclosed hacktool set (old stuff) - file TELNET.EXE from Windows ME"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "50d02d77dc6cc4dc2674f90762a2622e861d79b1"
      id = "fae22e0f-2f69-5dc6-984c-2c07530ad11a"
   strings:
      $s0 = "TELNET [host [port]]" fullword wide
      $s2 = "TELNET.EXE" fullword wide
      $s4 = "Microsoft(R) Windows(R) Millennium Operating System" fullword wide
      $s14 = "Software\\Microsoft\\Telnet" fullword wide
   condition:
      all of them
}
YARA Detection Rule: snifferport
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file snifferport.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "iphlpapi.DLL" fullword ascii
      $s5 = "ystem\\CurrentCorolSet\\" ascii
      $s11 = "Port.TX" fullword ascii
      $s12 = "32Next" fullword ascii
      $s13 = "V1.2 B" fullword ascii

Detection condition:
all of them

Full rule:
rule snifferport {
   meta:
      description = "Disclosed hacktool set (old stuff) - file snifferport.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "d14133b5eaced9b7039048d0767c[PII_REDACTED]44"
      id = "5b903344-18d2-5d3d-be66-7260a5f3ea4b"
   strings:
      $s0 = "iphlpapi.DLL" fullword ascii
      $s5 = "ystem\\CurrentCorolSet\\" ascii
      $s11 = "Port.TX" fullword ascii
      $s12 = "32Next" fullword ascii
      $s13 = "V1.2 B" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: sig_238_webget
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file webget.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Packed by exe32pack" ascii
      $s1 = "GET A HTTP/1.0" fullword ascii
      $s2 = " error " fullword ascii
      $s13 = "Downloa" ascii

Detection condition:
all of them

Full rule:
rule sig_238_webget {
   meta:
      description = "Disclosed hacktool set (old stuff) - file webget.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "36b5a5dee093aa846f906bbecf872a4e66989e42"
      id = "b03a2463-94fe-5050-8e3d-269101a03cda"
   strings:
      $s0 = "Packed by exe32pack" ascii
      $s1 = "GET A HTTP/1.0" fullword ascii
      $s2 = " error " fullword ascii
      $s13 = "Downloa" ascii
   condition:
      all of them
}
YARA Detection Rule: XYZCmd_zip_Folder_XYZCmd
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file XYZCmd.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Executes Command Remotely" fullword wide
      $s2 = "XYZCmd.exe" fullword wide
      $s6 = "No Client Software" fullword wide
      $s19 = "XYZCmd V1.0 For NT S" fullword ascii

Detection condition:
all of them

Full rule:
rule XYZCmd_zip_Folder_XYZCmd {
   meta:
      description = "Disclosed hacktool set (old stuff) - file XYZCmd.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "bbea5a94950b0e8aab4a12ad80e09b630dd98115"
      id = "c3d70b93-1d53-5403-bd22-d1e4bad5042b"
   strings:
      $s0 = "Executes Command Remotely" fullword wide
      $s2 = "XYZCmd.exe" fullword wide
      $s6 = "No Client Software" fullword wide
      $s19 = "XYZCmd V1.0 For NT S" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: ASPack_Chinese
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file ASPack Chinese.ini
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "= Click here if you want to get your registered copy of ASPack" fullword ascii
      $s1 = ";  For beginning of translate - copy english.ini into the yourlanguage.ini" fullword ascii
      $s2 = "E-Mail:                      shinlan@km169.net" fullword ascii
      $s8 = ";  Please, translate text only after simbol '='" fullword ascii
      $s19 = "= Compress with ASPack" fullword ascii

Detection condition:
all of them

Full rule:
rule ASPack_Chinese {
   meta:
      description = "Disclosed hacktool set (old stuff) - file ASPack Chinese.ini"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "02a9394bc2ec385876c4b4f61d72471ac8251a8e"
      id = "ac[PII_REDACTED]-5dec-9477-25be87361900"
   strings:
      $s0 = "= Click here if you want to get your registered copy of ASPack" fullword ascii
      $s1 = ";  For beginning of translate - copy english.ini into the yourlanguage.ini" fullword ascii
      $s2 = "E-Mail:                      shinlan@km169.net" fullword ascii
      $s8 = ";  Please, translate text only after simbol '='" fullword ascii
      $s19 = "= Compress with ASPack" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: aspbackdoor_EDIR
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file EDIR.ASP
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "response.write \"<a href='index.asp'>" fullword ascii
      $s3 = "if Request.Cookies(\"password\")=\"" ascii
      $s6 = "whichdir=server.mappath(Request(\"path\"))" fullword ascii
      $s7 = "Set fs = CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
      $s19 = "whichdir=Request(\"path\")" fullword ascii

Detection condition:
all of them

Full rule:
rule aspbackdoor_EDIR {
   meta:
      description = "Disclosed hacktool set (old stuff) - file EDIR.ASP"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "03367ad891b1580cfc864e8a03850368cbf3e0bb"
      id = "0895091a-b620-5746-8245-d44716ec2bbe"
   strings:
      $s1 = "response.write \"<a href='index.asp'>" fullword ascii
      $s3 = "if Request.Cookies(\"password\")=\"" ascii
      $s6 = "whichdir=server.mappath(Request(\"path\"))" fullword ascii
      $s7 = "Set fs = CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
      $s19 = "whichdir=Request(\"path\")" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: ByPassFireWall_zip_Folder_Ie
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file Ie.dll
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "d:\\documents and settings\\loveengeng\\desktop\\source\\bypass\\lcc\\ie.dll" fullword ascii
      $s1 = "LOADER ERROR" fullword ascii
      $s5 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
      $s7 = "The ordinal %u could not be located in the dynamic link library %s" fullword ascii

Detection condition:
all of them

Full rule:
rule ByPassFireWall_zip_Folder_Ie {
   meta:
      description = "Disclosed hacktool set (old stuff) - file Ie.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "d1b9058f16399e182c9b78314ad18b975d882131"
      id = "7bd10fa1-be2d-5882-b4c7-b696612343e5"
   strings:
      $s0 = "d:\\documents and settings\\loveengeng\\desktop\\source\\bypass\\lcc\\ie.dll" fullword ascii
      $s1 = "LOADER ERROR" fullword ascii
      $s5 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
      $s7 = "The ordinal %u could not be located in the dynamic link library %s" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: EditKeyLogReadMe
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file EditKeyLogReadMe.txt
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "editKeyLog.exe KeyLog.exe," fullword ascii
      $s1 = "WinEggDrop.DLL" fullword ascii
      $s2 = "nc.exe" fullword ascii
      $s3 = "KeyLog.exe" fullword ascii
      $s4 = "EditKeyLog.exe" fullword ascii
      $s5 = "wineggdrop" fullword ascii

Detection condition:
3 of them

Full rule:
rule EditKeyLogReadMe {
   meta:
      description = "Disclosed hacktool set (old stuff) - file EditKeyLogReadMe.txt"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "dfa90540b0e58346f4b6ea12e30c1404e15fbe5a"
      id = "db083c04-9e5c-5cfd-b4d4-eecf28191b6b"
   strings:
      $s0 = "editKeyLog.exe KeyLog.exe," fullword ascii
      $s1 = "WinEggDrop.DLL" fullword ascii
      $s2 = "nc.exe" fullword ascii
      $s3 = "KeyLog.exe" fullword ascii
      $s4 = "EditKeyLog.exe" fullword ascii
      $s5 = "wineggdrop" fullword ascii
   condition:
      3 of them
}
YARA Detection Rule: PassSniffer_zip_Folder_readme
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file readme.txt
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "PassSniffer.exe" fullword ascii
      $s1 = "POP3/FTP Sniffer" fullword ascii
      $s2 = "Password Sniffer V1.0" fullword ascii

Detection condition:
1 of them

Full rule:
rule PassSniffer_zip_Folder_readme {
   meta:
      description = "Disclosed hacktool set (old stuff) - file readme.txt"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "a52545ae62ddb0ea52905cbb61d895a51bfe9bcd"
      id = "f5965aa8-0f78-56fd-8e3e-6dc013942cb3"
   strings:
      $s0 = "PassSniffer.exe" fullword ascii
      $s1 = "POP3/FTP Sniffer" fullword ascii
      $s2 = "Password Sniffer V1.0" fullword ascii
   condition:
      1 of them
}
YARA Detection Rule: sig_238_gina
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file gina.reg
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "\"gina\"=\"gina.dll\"" fullword ascii
      $s1 = "REGEDIT4" fullword ascii
      $s2 = "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon]" fullword ascii

Detection condition:
all of them

Full rule:
rule sig_238_gina {
   meta:
      description = "Disclosed hacktool set (old stuff) - file gina.reg"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "324acc52566baf4afdb0f3e4aaf76e42899e0cf6"
      id = "85c19493-e6d4-55e8-8[PII_REDACTED]e90cf"
   strings:
      $s0 = "\"gina\"=\"gina.dll\"" fullword ascii
      $s1 = "REGEDIT4" fullword ascii
      $s2 = "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon]" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: splitjoin
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file splitjoin.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Not for distribution without the authors permission" fullword wide
      $s2 = "Utility to split and rejoin files.0" fullword wide
      $s5 = "Copyright (c) Angus Johnson 2001-2002" fullword wide
      $s19 = "SplitJoin" fullword wide

Detection condition:
all of them

Full rule:
rule splitjoin {
   meta:
      description = "Disclosed hacktool set (old stuff) - file splitjoin.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "e4a9ef5d417038c4c76b72b5a636769a98bd2f8c"
      id = "2f1a69cd-34b3-5af0-a054-fe19d9becb25"
   strings:
      $s0 = "Not for distribution without the authors permission" fullword wide
      $s2 = "Utility to split and rejoin files.0" fullword wide
      $s5 = "Copyright (c) Angus Johnson 2001-2002" fullword wide
      $s19 = "SplitJoin" fullword wide
   condition:
      all of them
}
YARA Detection Rule: EditKeyLog
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file EditKeyLog.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "Press Any Ke" fullword ascii
      $s2 = "Enter 1 O" fullword ascii
      $s3 = "Bon >0 & <65535L" fullword ascii
      $s4 = "--Choose " fullword ascii

Detection condition:
all of them

Full rule:
rule EditKeyLog {
   meta:
      description = "Disclosed hacktool set (old stuff) - file EditKeyLog.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "a450c31f13c23426b24624f53873e4fc3777dc6b"
      id = "db083c04-9e5c-5cfd-b4d4-eecf28191b6b"
   strings:
      $s1 = "Press Any Ke" fullword ascii
      $s2 = "Enter 1 O" fullword ascii
      $s3 = "Bon >0 & <65535L" fullword ascii
      $s4 = "--Choose " fullword ascii
   condition:
      all of them
}
YARA Detection Rule: PassSniffer
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file PassSniffer.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s2 = "Sniff" fullword ascii
      $s3 = "GetLas" fullword ascii
      $s4 = "VersionExA" fullword ascii
      $s10 = " Only RuntUZ" fullword ascii
      $s12 = "emcpysetprintf\\" ascii
      $s13 = "WSFtartup" fullword ascii

Detection condition:
all of them

Full rule:
rule PassSniffer {
   meta:
      description = "Disclosed hacktool set (old stuff) - file PassSniffer.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "dcce4c577728e8edf7ed38ac6ef6a1e68afb2c9f"
      id = "f5965aa8-0f78-56fd-8e3e-6dc013942cb3"
   strings:
      $s2 = "Sniff" fullword ascii
      $s3 = "GetLas" fullword ascii
      $s4 = "VersionExA" fullword ascii
      $s10 = " Only RuntUZ" fullword ascii
      $s12 = "emcpysetprintf\\" ascii
      $s13 = "WSFtartup" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: aspfile2
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file aspfile2.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "response.write \"command completed success!\" " fullword ascii
      $s1 = "for each co in foditems " fullword ascii
      $s3 = "<input type=text name=text6 value=\"<%= szCMD6 %>\"><br> " fullword ascii
      $s19 = "<title>Hello! Welcome </title>" fullword ascii

Detection condition:
all of them

Full rule:
rule aspfile2 {
   meta:
      description = "Disclosed hacktool set (old stuff) - file aspfile2.asp"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "14efbc6cb01b809ad75a535d32b9da4df517ff29"
      id = "42bbcc16-a6d7-53d7-8651-1a28c6b26ee8"
   strings:
      $s0 = "response.write \"command completed success!\" " fullword ascii
      $s1 = "for each co in foditems " fullword ascii
      $s3 = "<input type=text name=text6 value=\"<%= szCMD6 %>\"><br> " fullword ascii
      $s19 = "<title>Hello! Welcome </title>" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: UnPack_rar_Folder_InjectT
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file InjectT.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "%s -Install                          -->To Install The Service" fullword ascii
      $s1 = "Explorer.exe" fullword ascii
      $s2 = "%s -Start                            -->To Start The Service" fullword ascii
      $s3 = "%s -Stop                             -->To Stop The Service" fullword ascii
      $s4 = "The Port Is Out Of Range" fullword ascii
      $s7 = "Fail To Set The Port" fullword ascii
      $s11 = "\\psapi.dll" ascii
      $s20 = "TInject.Dll" fullword ascii

      $x1 = "Software\\Microsoft\\Internet Explorer\\WinEggDropShell" fullword ascii
      $x2 = "injectt.exe" fullword ascii

Detection condition:
(1 of ($x*)) and (3 of ($s*))

Full rule:
rule UnPack_rar_Folder_InjectT {
   meta:
      description = "Disclosed hacktool set (old stuff) - file InjectT.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "80f39e77d4a34ecc6621ae0f4d5be7563ab27ea6"
      id = "cc7d1a36-1214-5a14-8589-9eb2339a8700"
   strings:
      $s0 = "%s -Install                          -->To Install The Service" fullword ascii
      $s1 = "Explorer.exe" fullword ascii
      $s2 = "%s -Start                            -->To Start The Service" fullword ascii
      $s3 = "%s -Stop                             -->To Stop The Service" fullword ascii
      $s4 = "The Port Is Out Of Range" fullword ascii
      $s7 = "Fail To Set The Port" fullword ascii
      $s11 = "\\psapi.dll" ascii
      $s20 = "TInject.Dll" fullword ascii

      $x1 = "Software\\Microsoft\\Internet Explorer\\WinEggDropShell" fullword ascii
      $x2 = "injectt.exe" fullword ascii
   condition:
      (1 of ($x*)) and (3 of ($s*))
}
YARA Detection Rule: Jc_WinEggDrop_Shell
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file Jc.WinEggDrop Shell.txt
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Sniffer.dll" fullword ascii
      $s4 = ":Execute net.exe user Administrator pass" fullword ascii
      $s5 = "Fport.exe or mport.exe " fullword ascii
      $s6 = ":Password Sniffering Is Running |Not Running " fullword ascii
      $s9 = ": The Terminal Service Port Has Been Set To NewPort" fullword ascii
      $s15 = ": Del www.exe                   " fullword ascii
      $s20 = ":Dir *.exe                    " fullword ascii

Detection condition:
2 of them

Full rule:
rule Jc_WinEggDrop_Shell {
   meta:
      description = "Disclosed hacktool set (old stuff) - file Jc.WinEggDrop Shell.txt"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "820674b59f32f2cf72df50ba4411d7132d863ad2"
      id = "219df3a1-fe1c-5d33-ab3e-1b3cbd104c9e"
   strings:
      $s0 = "Sniffer.dll" fullword ascii
      $s4 = ":Execute net.exe user Administrator pass" fullword ascii
      $s5 = "Fport.exe or mport.exe " fullword ascii
      $s6 = ":Password Sniffering Is Running |Not Running " fullword ascii
      $s9 = ": The Terminal Service Port Has Been Set To NewPort" fullword ascii
      $s15 = ": Del www.exe                   " fullword ascii
      $s20 = ":Dir *.exe                    " fullword ascii
   condition:
      2 of them
}
YARA Detection Rule: aspbackdoor_asp1
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file asp1.txt
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "param = \"driver={Microsoft Access Driver (*.mdb)}\" " fullword ascii
      $s1 = "conn.Open param & \";dbq=\" & Server.MapPath(\"scjh.mdb\") " fullword ascii
      $s6 = "set rs=conn.execute (sql)%> " fullword ascii
      $s7 = "<%set Conn = Server.CreateObject(\"ADODB.Connection\") " fullword ascii
      $s10 = "<%dim ktdh,scph,scts,jhqtsj,yhxdsj,yxj,rwbh " fullword ascii
      $s15 = "sql=\"select * from scjh\" " fullword ascii

Detection condition:
all of them

Full rule:
rule aspbackdoor_asp1 {
   meta:
      description = "Disclosed hacktool set (old stuff) - file asp1.txt"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "9ef9f34392a673c64525fcd56449a9fb1d1f3c50"
      id = "fa5128c5-efd5-55dd-880a-2952942e2035"
   strings:
      $s0 = "param = \"driver={Microsoft Access Driver (*.mdb)}\" " fullword ascii
      $s1 = "conn.Open param & \";dbq=\" & Server.MapPath(\"scjh.mdb\") " fullword ascii
      $s6 = "set rs=conn.execute (sql)%> " fullword ascii
      $s7 = "<%set Conn = Server.CreateObject(\"ADODB.Connection\") " fullword ascii
      $s10 = "<%dim ktdh,scph,scts,jhqtsj,yhxdsj,yxj,rwbh " fullword ascii
      $s15 = "sql=\"select * from scjh\" " fullword ascii
   condition:
      all of them
}
YARA Detection Rule: QQ_zip_Folder_QQ
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file QQ.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "EMAIL:haoq@neusoft.com" fullword wide
      $s1 = "EMAIL:haoq@neusoft.com" fullword wide
      $s4 = "QQ2000b.exe" fullword wide
      $s5 = "haoq@neusoft.com" fullword ascii
      $s9 = "QQ2000b.exe" fullword ascii
      $s10 = "\\qq2000b.exe" ascii
      $s12 = "WINDSHELL STUDIO[WINDSHELL " fullword wide
      $s17 = "SOFTWARE\\HAOQIANG\\" ascii

Detection condition:
5 of them

Full rule:
rule QQ_zip_Folder_QQ {
   meta:
      description = "Disclosed hacktool set (old stuff) - file QQ.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "9f8e3f40f1ac8c1fa15a6621b49413d815f46cfb"
      id = "30da6292-f670-5b73-985a-3028e20607be"
   strings:
      $s0 = "EMAIL:haoq@neusoft.com" fullword wide
      $s1 = "EMAIL:haoq@neusoft.com" fullword wide
      $s4 = "QQ2000b.exe" fullword wide
      $s5 = "haoq@neusoft.com" fullword ascii
      $s9 = "QQ2000b.exe" fullword ascii
      $s10 = "\\qq2000b.exe" ascii
      $s12 = "WINDSHELL STUDIO[WINDSHELL " fullword wide
      $s17 = "SOFTWARE\\HAOQIANG\\" ascii
   condition:
      5 of them
}