deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: MAL_Payload_F5_BIG_IP_Exploitations_Jul20_1
Repository: Neo23x0/signature-base
Detects: Detects code found in report on exploits against CVE-2020-5902 F5 BIG-IP vulnerability by NCC group
Author: Florian Roth (Nextron Systems)
Reference: https://research.nccgroup.com/2020/07/05/rift-f5-networks-k52145254-tmui-rce-vulnerability-cve-2020-5902-intelligence/

Pattern signatures:
$x1 = "rm -f /etc/ld.so.preload" ascii fullword
      $x2 = "echo \"* * * * * $LDR" ascii
      $x3 = ".sh -o /tmp/in.sh" ascii
      $x4 = "chmod a+x /etc/.modules/.tmp" ascii
      $x5 = "chmod +x /var/log/F5-logcheck"

      $s1 = "ulimit -n 65535" ascii fullword
      $s2 = "-s /usr/bin/wget " ascii
      $s3 = ".sh | sh" ascii

Detection condition:
filesize < 300KB and
      ( 1 of ($x*) or 3 of them )

Full rule:
rule MAL_Payload_F5_BIG_IP_Exploitations_Jul20_1 {
   meta:
      description = "Detects code found in report on exploits against CVE-2020-5902 F5 BIG-IP vulnerability by NCC group"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://research.nccgroup.com/2020/07/05/rift-f5-networks-k52145254-tmui-rce-vulnerability-cve-2020-5902-intelligence/"
      date = "2020-06-07"
      score = 75
      id = "57705ba1-c0ad-5ca6-8539-44d9da6b5942"
   strings:
      $x1 = "rm -f /etc/ld.so.preload" ascii fullword
      $x2 = "echo \"* * * * * $LDR" ascii
      $x3 = ".sh -o /tmp/in.sh" ascii
      $x4 = "chmod a+x /etc/.modules/.tmp" ascii
      $x5 = "chmod +x /var/log/F5-logcheck"

      $s1 = "ulimit -n 65535" ascii fullword
      $s2 = "-s /usr/bin/wget " ascii
      $s3 = ".sh | sh" ascii
   condition:
      filesize < 300KB and
      ( 1 of ($x*) or 3 of them )
}
YARA Detection Rule: IceFog_Malware_Feb18_1
Repository: Neo23x0/signature-base
Detects: Detects IceFog malware
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/ClearskySec/status/[PII_REDACTED]18669057

Pattern signatures:
$s1 = "cmd /c %c%s%c" fullword ascii
      $s2 = "temp.bat" fullword ascii
      $s3 = "c:\\windows\\debug\\wia\\help" fullword wide
      $s4 = "/getorder.aspx?hostname=" fullword wide
      $s5 = "\\filecfg_temp.dat" wide
      $s6 = "Unknown operating system " fullword wide
      $s7 = "kastygost.compress.to" fullword wide
      $s8 = "/downloads/" wide
      $s9 = "\\key.dat" wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 2000KB and 4 of them

Full rule:
rule IceFog_Malware_Feb18_1 {
   meta:
      description = "Detects IceFog malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/ClearskySec/status/[PII_REDACTED]18669057"
      date = "2018-02-26"
      modified = "2023-01-06"
      hash1 = "480373cffc4e60aa5be2954a156e37d689b92e6e[PII_REDACTED]0f2ce59d30b9ec"
      id = "ce8e3a9b-9f4b-534c-983d-bb5490da5768"
   strings:
      $s1 = "cmd /c %c%s%c" fullword ascii
      $s2 = "temp.bat" fullword ascii
      $s3 = "c:\\windows\\debug\\wia\\help" fullword wide
      $s4 = "/getorder.aspx?hostname=" fullword wide
      $s5 = "\\filecfg_temp.dat" wide
      $s6 = "Unknown operating system " fullword wide
      $s7 = "kastygost.compress.to" fullword wide
      $s8 = "/downloads/" wide
      $s9 = "\\key.dat" wide
   condition:
      uint16(0) == 0x5a4d and filesize < 2000KB and 4 of them
}
YARA Detection Rule: SUSP_MalDoc_ExcelMacro
Repository: Neo23x0/signature-base
Detects: Detects malicious Excel macro Artifacts
Author: James Quinn
Reference: YARA Exchange - Undisclosed Macro Builder

Pattern signatures:
$artifact1 = {5c 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 2e 00 ?? 00 ?? 00}
    $url1 = "http://" wide
    $url2 = "https://" wide
    $import1 = "URLDownloadToFileA" wide ascii
    $macro = "xl/macrosheets/"

Detection condition:
uint16(0) == 0x4b50 and
    filesize < 2000KB and
    $artifact1 and $macro and $import1 and 1 of ($url*)

Full rule:
rule SUSP_MalDoc_ExcelMacro {
  meta:
    description = "Detects malicious Excel macro Artifacts"
    author = "James Quinn"
    date = "2020-11-03"
    reference = "YARA Exchange - Undisclosed Macro Builder"
    id = "76806717-a9a8-520e-b6b6-7718eb088de5"
  strings:
    $artifact1 = {5c 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 2e 00 ?? 00 ?? 00}
    $url1 = "http://" wide
    $url2 = "https://" wide
    $import1 = "URLDownloadToFileA" wide ascii
    $macro = "xl/macrosheets/"
  condition:
    uint16(0) == 0x4b50 and
    filesize < 2000KB and
    $artifact1 and $macro and $import1 and 1 of ($url*)
}
YARA Detection Rule: SUSP_autocad_lsp_malware
Repository: Neo23x0/signature-base
Detects: Recognizes malicious autocad files written in LISP
Author: John Lambert @JohnLaTwC

Pattern signatures:
$s1 = /\(chr\s+\d+\)\s*\(chr\s+\d+\)\s*\(chr\s+\d+\)\s*\(chr\s+\d+\)/    //obfuscation
        $s2 = /vl\-list\-\>string\s+\'\(\d+\s+\d+\s+\d+\s+\d+\s+\d+\s+/ //obfucation c116cc4db6f77c580c1c4f8acda537ed04e597739bc83011773dbeb77adf93e3

        $m1 = "strcat" nocase fullword
        $m2 = "write-line" nocase fullword
        $m3 = "open" nocase fullword
        $m4 = /acad\w*\.lsp\"/ nocase fullword


        $n1 = "vl-registry-write" nocase fullword
        $n2 = "NOHIDDEN" nocase fullword
        $n3 = "vlax-create-object " nocase fullword

Detection condition:
filesize < 1MB
        and uint8(0) == 0x28 
        and (   
            1 of ($s*)
            or all of ($m*)
            or all of ($n*)
        )

Full rule:
rule SUSP_autocad_lsp_malware {
    meta:
        description = "Recognizes malicious autocad files written in LISP"
        author = "John Lambert @JohnLaTwC"
        date = "2019-02-04"
        reference1 = "http://cadablog.blogspot.com/2012/06/acadmedrea-malware-autocad-based-virus.html"
        hash1= "1313398e2f39fcf17225c7e915b92bd74292d427163112d70b82f271359b84d5"
        hash2= "2382e6908e6b44c0676c537cb8caa239c8938cb01e62a45c7247d40ab7dbf0ad"
        hash3= "23cf3e7f41a755a45e396e5caa3e753e64655b91fe665808f71aa68718670dc8"
        hash4= "23f018135afc4890e1e09bef9386e45e2236fc43550383b7888cddbdefbcd950"
        hash5= "4a8da078a02fc49b7f13cd19d10519b1bf31ed0ab04268f018ad4733918e28ff"
        hash6= "4cca7b530213ef71b2e69a5b11178b61044f93dc60f4e8e568ddb3bb06749ba2"
        hash7= "[PII_REDACTED]e1ebf884380f5da7d26dff527d13922d3b3f8a3b5ec9152b9dfa40"
        hash8= "53ef3029f36a3a2b912a722d64eef04f599f6f683c6dcb31a122ab1c98f38700"
        hash9= "7f7d78931370fa693cbfa50aadecc09b4ab93917dcde3a653bd67fa6dc274cdc"
        hash10= "8147cc97b6203c7eccfbd10457eb52527f74180ebae79bf3cb9c9edb582e708c"
        hash11= "8a3113ceb45725539e4ccef5ea1482c29b2bbe0ce7ede72f59f9949a0e04c5cd"
        hash12= "a0c77993f84ca8fb[PII_REDACTED]326bc907b003327f5885660ea5ba47e2cbc6de"
        hash13= "a20ac5e0bfa2ee3cb[PII_REDACTED]c23d1f94a1ed1b59cc3d351e5602d7206178c"
        hash14= "b201969ed7bf782d01011211b48bfccb9dd41a3a5a7456cdff2167f1e4d1b954"
        hash15= "b2bac49288329a777e7aa7001e9383eec75719c08f2aa8c278b44fabeb74844f"
        hash16= "b772dce92319bb48df39db6ab701761bd7645a771fd7f394510d5951695e7e96"
        hash17= "c116cc4db6f77c580c1c4f8acda537ed04e597739bc83011773dbeb77adf93e3"
        hash18= "ca1b9026b5d69c0981ca088330180d4865602fc2b514fd838664d3e11eab4468"
        hash19= "d7a814d677f9f9dd9666dc4f4bb9cca88fa90bdb074e87006e8810eef9a0fb32"
        hash20= "e4acfb69006b8aecf5801e36e2c69ccfeea2e8cbad4ceda9228d2dae2c8fd023"
        hash21= "f9d6b894ca[PII_REDACTED]58a4e2c78de84bf59260
YARA Detection Rule: MAL_JS_NPM_SupplyChain_Attack_Sep25
Repository: Neo23x0/signature-base
Detects: Detects obfuscated JavaScript in NPM packages used in supply chain crypto stealer attacks in September 2025
Author: Florian Roth
Reference: https://www.linkedin.com/feed/update/urn:li:activity:[PII_REDACTED]992437760/

Pattern signatures:
$x1 = "const _0x112fa8=_0x180f;(function(_0x13c8b9" ascii

      $fp1 = "<html"
      $fp2 = "<xml "
      $fp3 = "<?xml"

Detection condition:
filesize < 200KB
      and 1 of ($x*)
      and not 1 of ($fp*)

Full rule:
rule MAL_JS_NPM_SupplyChain_Attack_Sep25 {
   meta:
      description = "Detects obfuscated JavaScript in NPM packages used in supply chain crypto stealer attacks in September 2025"
      author = "Florian Roth"
      reference = "https://www.linkedin.com/feed/update/urn:li:activity:[PII_REDACTED]992437760/"
      date = "2025-09-09"
      modified = "2025-11-29"
      score = 85
      hash1 = "16f6c756bc8ce5ef5d9aa1ded0f811ec0c9cee3d8f85cc151b8ca1df7b8a4337"
   strings:
      $x1 = "const _0x112fa8=_0x180f;(function(_0x13c8b9" ascii

      $fp1 = "<html"
      $fp2 = "<xml "
      $fp3 = "<?xml"
   condition:
      filesize < 200KB
      and 1 of ($x*)
      and not 1 of ($fp*)
}
YARA Detection Rule: MAL_JS_NPM_SupplyChain_Compromise_Sep25
Repository: Neo23x0/signature-base
Detects: Detects a supply chain compromise in NPM packages (TinyColor, CrowdStrike etc.)
Author: Florian Roth
Reference: https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages

Pattern signatures:
$x1 = "if (plat === \"linux\") return \"https://github.com/trufflesecurity/trufflehog/releases"

      $sa1 = "curl -d \"$CONTENTS\" https://webhook.site/" ascii
      $sa2 = "curl -s -X POST -d \"$CONTENTS\" \"https://webhook.site/"

      $sb1 = " | base64 -w 0 | " ascii
      $sb2 = " | base64 -w0)"

Detection condition:
filesize < 20MB
      and (
         1 of ($x*)
         or (
            1 of ($sa*)
            and 1 of ($sb*)
         )
      )
      and not uint8(0) == 0x7b  // JSON {

Full rule:
rule MAL_JS_NPM_SupplyChain_Compromise_Sep25 {
   meta:
      description = "Detects a supply chain compromise in NPM packages (TinyColor, CrowdStrike etc.)"
      author = "Florian Roth"
      reference = "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages"
      date = "2025-09-16"
      modified = "2025-09-17"
      score = 80
   strings:
      $x1 = "if (plat === \"linux\") return \"https://github.com/trufflesecurity/trufflehog/releases"

      $sa1 = "curl -d \"$CONTENTS\" https://webhook.site/" ascii
      $sa2 = "curl -s -X POST -d \"$CONTENTS\" \"https://webhook.site/"

      $sb1 = " | base64 -w 0 | " ascii
      $sb2 = " | base64 -w0)"
   condition:
      filesize < 20MB
      and (
         1 of ($x*)
         or (
            1 of ($sa*)
            and 1 of ($sb*)
         )
      )
      and not uint8(0) == 0x7b  // JSON {
}
YARA Detection Rule: FreeMilk_APT_Mal_1
Repository: Neo23x0/signature-base
Detects: Detects malware from FreeMilk campaign
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/

Pattern signatures:
$x1 = "\\milk\\Release\\milk.pdb" ascii
      $x2 = "E:\\BIG_POOH\\Project\\" ascii
      $x3 = "Windows-KB271854-x86.exe" fullword wide

      $s1 = "Windows-KB275122-x86.exe" fullword wide
      $s2 = "\\wsatra.tmp" wide
      $s3 = "%s\\Rar0tmpExtra%d.rtf" fullword wide
      $s4 = "\"%s\" help" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and (
            pe.imphash() == "108aa007b3d1b4817ff4c04d9b254b39" or
            1 of ($x*) or
            4 of them
         )

Full rule:
rule FreeMilk_APT_Mal_1 {
   meta:
      description = "Detects malware from FreeMilk campaign"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
      date = "2017-10-05"
      hash1 = "34478d6692f8c28332751b31fd695b799d4ab36a8c12f7b728e2cb99ae2efcd9"
      hash2 = "35273d6c25665a19ac14d469e[PII_REDACTED]be655ee19b5b247cb1afef626c9f2"
      hash3 = "0f82ea2f92c7e906ee9ffbbd8212be6a8545b9bb0200eda09cce0ba9d7cb1313"
      id = "eff37dba-d4a9-5e3d-9452-49f04ddcbe0b"
   strings:
      $x1 = "\\milk\\Release\\milk.pdb" ascii
      $x2 = "E:\\BIG_POOH\\Project\\" ascii
      $x3 = "Windows-KB271854-x86.exe" fullword wide

      $s1 = "Windows-KB275122-x86.exe" fullword wide
      $s2 = "\\wsatra.tmp" wide
      $s3 = "%s\\Rar0tmpExtra%d.rtf" fullword wide
      $s4 = "\"%s\" help" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 300KB and (
            pe.imphash() == "108aa007b3d1b4817ff4c04d9b254b39" or
            1 of ($x*) or
            4 of them
         )
}
YARA Detection Rule: FreeMilk_APT_Mal_2
Repository: Neo23x0/signature-base
Detects: Detects malware from FreeMilk campaign
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/

Pattern signatures:
$s1 = "failed to take the screenshot. err: %d" fullword ascii
      $s2 = "runsample" fullword wide
      $s3 = "%s%02X%02X%02X%02X%02X%02X:" fullword wide
      $s4 = "win-%d.%d.%d-%d" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 400KB and (
         pe.imphash() == "b86f7d2c1c182ec4c074ae1e16b7a3f5" or
         all of them
      )

Full rule:
rule FreeMilk_APT_Mal_2 {
   meta:
      description = "Detects malware from FreeMilk campaign"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
      date = "2017-10-05"
      hash1 = "7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54df"
      id = "ef5f400c-16f8-5374-af16-c8530ddb87ee"
   strings:
      $s1 = "failed to take the screenshot. err: %d" fullword ascii
      $s2 = "runsample" fullword wide
      $s3 = "%s%02X%02X%02X%02X%02X%02X:" fullword wide
      $s4 = "win-%d.%d.%d-%d" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 400KB and (
         pe.imphash() == "b86f7d2c1c182ec4c074ae1e16b7a3f5" or
         all of them
      )
}
YARA Detection Rule: FreeMilk_APT_Mal_3
Repository: Neo23x0/signature-base
Detects: Detects malware from FreeMilk campaign
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/

Pattern signatures:
$s1 = "CMD.EXE /C \"%s\"" fullword wide
      $s2 = "\\command\\start.exe" wide
      $s3 = ".bat;.com;.cmd;.exe" fullword wide
      $s4 = "Unexpected failure opening HKCR key: %d" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 900KB and all of them )

Full rule:
rule FreeMilk_APT_Mal_3 {
   meta:
      description = "Detects malware from FreeMilk campaign"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
      date = "2017-10-05"
      hash1 = "ef40f7ddff404d1193e025081780e32f88883fa4dd496f4189084d772a435cb2"
      id = "152781f0-756b-50ab-b588-4af5fa4ce419"
   strings:
      $s1 = "CMD.EXE /C \"%s\"" fullword wide
      $s2 = "\\command\\start.exe" wide
      $s3 = ".bat;.com;.cmd;.exe" fullword wide
      $s4 = "Unexpected failure opening HKCR key: %d" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 900KB and all of them )
}
YARA Detection Rule: FreeMilk_APT_Mal_4
Repository: Neo23x0/signature-base
Detects: Detects malware from FreeMilk campaign
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/

Pattern signatures:
$x1 = "base64Encoded=\"TVqQAAMAAAAE" ascii

      $s1 = "SOFTWARE\\Clients\\StartMenuInternet\\firefox.exe\\shell\\open\\command" fullword wide
      $s2 = "'Wscript.echo \"Base64 encoded: \" + base64Encoded" fullword ascii
      $s3 = "\\Google\\Chrome\\User Data\\Default\\Login Data" ascii
      $s4 = "outFile=sysDir&\"\\rundll32.exe\"" fullword ascii
      $s5 = "set shell = WScript.CreateObject(\"WScript.Shell\")" fullword ascii
      $s6 = "command =outFile &\" sysupdate\"" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 3000KB and (
         ( pe.exports("getUpdate") and pe.number_of_exports == 1 ) or
         1 of ($x*) or
         3 of them
      )

Full rule:
rule FreeMilk_APT_Mal_4 {
   meta:
      description = "Detects malware from FreeMilk campaign"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
      date = "2017-10-05"
      hash1 = "99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5"
      id = "44f919f7-8eda-5e70-88d5-9e81a761192c"
   strings:
      $x1 = "base64Encoded=\"TVqQAAMAAAAE" ascii

      $s1 = "SOFTWARE\\Clients\\StartMenuInternet\\firefox.exe\\shell\\open\\command" fullword wide
      $s2 = "'Wscript.echo \"Base64 encoded: \" + base64Encoded" fullword ascii
      $s3 = "\\Google\\Chrome\\User Data\\Default\\Login Data" ascii
      $s4 = "outFile=sysDir&\"\\rundll32.exe\"" fullword ascii
      $s5 = "set shell = WScript.CreateObject(\"WScript.Shell\")" fullword ascii
      $s6 = "command =outFile &\" sysupdate\"" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 3000KB and (
         ( pe.exports("getUpdate") and pe.number_of_exports == 1 ) or
         1 of ($x*) or
         3 of them
      )
}
YARA Detection Rule: EXPL_CVE_2021_40444_Document_Rels_XML
Repository: Neo23x0/signature-base
Detects: Detects indicators found in weaponized documents that exploit CVE-2021-40444
Author: Jeremy Brown / @alteredbytes
Reference: https://twitter.com/AlteredBytes/status/[PII_REDACTED]49952772

Pattern signatures:
$b1 = "/relationships/oleObject" ascii 
      $b2 = "/relationships/attachedTemplate" ascii

      $c1 = "Target=\"mhtml:http" nocase
      $c2 = "!x-usc:http" nocase
      $c3 = "TargetMode=\"External\"" nocase

Detection condition:
uint32(0) == 0x6D783F3C
      and filesize < 10KB
      and 1 of ($b*)
      and all of ($c*)

Full rule:
rule EXPL_CVE_2021_40444_Document_Rels_XML {
   meta:
      description = "Detects indicators found in weaponized documents that exploit CVE-2021-40444"
      author = "Jeremy Brown / @alteredbytes"
      reference = "https://twitter.com/AlteredBytes/status/[PII_REDACTED]49952772"
      date = "2021-09-10"
      id = "812bb68e-71ea-5a9a-8d39-ab99fdaa6c58"
   strings:
      $b1 = "/relationships/oleObject" ascii 
      $b2 = "/relationships/attachedTemplate" ascii

      $c1 = "Target=\"mhtml:http" nocase
      $c2 = "!x-usc:http" nocase
      $c3 = "TargetMode=\"External\"" nocase
   condition:
      uint32(0) == 0x6D783F3C
      and filesize < 10KB
      and 1 of ($b*)
      and all of ($c*)
}
YARA Detection Rule: EXPL_MAL_MalDoc_OBFUSCT_MHTML_Sep21_1
Repository: Neo23x0/signature-base
Detects: Detects suspicious office reference files including an obfuscated MHTML reference exploiting CVE-2021-40444
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/decalage2/status/[PII_REDACTED]90014984?s=20

Pattern signatures:
$h1 = "<?xml " ascii wide
      $s1 = "109;&#104;&#116;&#109;&#108;&#58;&#104;&#116;&#109;&#108" ascii wide

Detection condition:
filesize < 25KB and all of them

Full rule:
rule EXPL_MAL_MalDoc_OBFUSCT_MHTML_Sep21_1 {
   meta:
      description = "Detects suspicious office reference files including an obfuscated MHTML reference exploiting CVE-2021-40444"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/decalage2/status/[PII_REDACTED]90014984?s=20"
      date = "2021-09-18"
      score = 90
      hash = "84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69"
      id = "781cfd61-d5ac-58e5-868f-dbd2a2df3500"
   strings:
      $h1 = "<?xml " ascii wide
      $s1 = "109;&#104;&#116;&#109;&#108;&#58;&#104;&#116;&#109;&#108" ascii wide
   condition:
      filesize < 25KB and all of them
}
YARA Detection Rule: EXPL_XML_Encoded_CVE_2021_40444
Repository: Neo23x0/signature-base
Detects: Detects possible CVE-2021-40444 with no encoding, HTML/XML entity (and hex notation) encoding, or all 3
Author: James E.C, Proofpoint
Reference: https://twitter.com/sudosev/status/[PII_REDACTED]29377282

Pattern signatures:
$h1 = "<?xml " ascii wide
      $t_xml_r = /Target[\s]{0,20}=[\s]{0,20}\["']([Mm]|&#(109|77|x6d|x4d);)([Hh]|&#(104|72|x68|x48);)([Tt]|&#(116|84|x74|x54);)([Mm]|&#(109|77|x6d|x4d);)([Ll]|&#(108|76|x6c|x4c);)(:|&#58;|&#x3a)/
      $t_mode_r = /TargetMode[\s]{0,20}=[\s]{0,20}\["']([Ee]|&#(x45|x65|69|101);)([Xx]|&#(x58|x78|88|120);)([Tt]|&#(x74|x54|84|116);)/

Detection condition:
filesize < 500KB and $h1 and all of ($t_*)

Full rule:
rule EXPL_XML_Encoded_CVE_2021_40444 {
   meta:
      author = "James E.C, Proofpoint"
      description = "Detects possible CVE-2021-40444 with no encoding, HTML/XML entity (and hex notation) encoding, or all 3"
      reference = "https://twitter.com/sudosev/status/[PII_REDACTED]29377282"
      date = "2021-09-18"
      modified = "2021-09-19"
      score = 70
      hash = "13DE9F39B1AD232E704B5E0B5051800FCD844E9F661185ACE8287A23E9B3868E" // document.xml
      hash = "84674ACFFBA5101C8AC518019A9AFE2A78A675EF3525A44DCEDDEED8A0092C69" // original .docx
      id = "4bf9ec64-c662-5c8f-9e58-12a7412ef07d"
   strings:
      $h1 = "<?xml " ascii wide
      $t_xml_r = /Target[\s]{0,20}=[\s]{0,20}\["']([Mm]|&#(109|77|x6d|x4d);)([Hh]|&#(104|72|x68|x48);)([Tt]|&#(116|84|x74|x54);)([Mm]|&#(109|77|x6d|x4d);)([Ll]|&#(108|76|x6c|x4c);)(:|&#58;|&#x3a)/
      $t_mode_r = /TargetMode[\s]{0,20}=[\s]{0,20}\["']([Ee]|&#(x45|x65|69|101);)([Xx]|&#(x58|x78|88|120);)([Tt]|&#(x74|x54|84|116);)/
   condition:
      filesize < 500KB and $h1 and all of ($t_*)
}
YARA Detection Rule: SUSP_OBFUSC_Indiators_XML_OfficeDoc_Sep21_1
Repository: Neo23x0/signature-base
Detects: Detects suspicious encodings in fields used in reference files found in weaponized MS Office documents
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/sudosev/status/[PII_REDACTED]29377282

Pattern signatures:
$h1 = "<?xml " ascii wide

      $xml_e = "Target=\"&#" ascii wide
      $xml_mode_1 = "TargetMode=\"&#" ascii wide

Detection condition:
filesize < 500KB and $h1 and 1 of ($xml*)

Full rule:
rule SUSP_OBFUSC_Indiators_XML_OfficeDoc_Sep21_1 : Windows CVE {
   meta:
      author = "Florian Roth (Nextron Systems)"
      description = "Detects suspicious encodings in fields used in reference files found in weaponized MS Office documents"
      reference = "https://twitter.com/sudosev/status/[PII_REDACTED]29377282"
      date = "2021-09-18"
      score = 65
      hash = "13DE9F39B1AD232E704B5E0B5051800FCD844E9F661185ACE8287A23E9B3868E" // document.xml
      hash = "84674ACFFBA5101C8AC518019A9AFE2A78A675EF3525A44DCEDDEED8A0092C69" // original .docx
      id = "ffcaf270-f574-5692-90e5-6776c34eb71b"
   strings:
      $h1 = "<?xml " ascii wide

      $xml_e = "Target=\"&#" ascii wide
      $xml_mode_1 = "TargetMode=\"&#" ascii wide
   condition:
      filesize < 500KB and $h1 and 1 of ($xml*)
}