deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT_MAL_CN_Wocao_webshell_ver_jsp
Repository: Neo23x0/signature-base
Detects: Strings from the ver.jsp webshell
Author: Fox-IT SRT
Reference: https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/

Pattern signatures:
$a = "String strLogo = request.getParameter(\"id\")"
        $b = "!strLogo.equals(\"256\")"
        $c = "boolean chkos = msg.startsWith"
        $d = "while((c = er.read()) != -1)"
        $e = "out.print((char)c);}in.close()"
        $f = "out.print((char)c);}er.close()"

Detection condition:
1 of them

Full rule:
rule APT_MAL_CN_Wocao_webshell_ver_jsp {
    meta:
        description = "Strings from the ver.jsp webshell"
        author = "Fox-IT SRT"
        reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"

        id = "b2828b84-8934-5111-9345-683a07025070"
    strings:
        $a = "String strLogo = request.getParameter(\"id\")"
        $b = "!strLogo.equals(\"256\")"
        $c = "boolean chkos = msg.startsWith"
        $d = "while((c = er.read()) != -1)"
        $e = "out.print((char)c);}in.close()"
        $f = "out.print((char)c);}er.close()"

    condition:
        1 of them
}
YARA Detection Rule: APT_MAL_CN_Wocao_webshell_webinfo
Repository: Neo23x0/signature-base
Detects: Generic strings from webinfo.war webshells
Author: Fox-IT SRT
Reference: https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/

Pattern signatures:
$var1 = "String strLogo = request.getParameter"
        $var2 = "String content = request.getParameter(\"content\");"
        $var3 = "String basePath=request.getScheme()"
        $var4 = "!strLogo.equals("
        $var5 = "if(path!=null && !path.equals(\"\") && content!=null"
        $var6 = "File newfile=new File(path);"

        $str1 = "Save Success!"
        $str2 = "Save Failed!"

Detection condition:
2 of ($var*) or (all of ($str*) and 1 of ($var*))

Full rule:
rule APT_MAL_CN_Wocao_webshell_webinfo {
    meta:
        description = "Generic strings from webinfo.war webshells"
        author = "Fox-IT SRT"
        reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"

        id = "b8477f62-f3f6-5526-b0e3-9b794fefaa1f"
    strings:
        $var1 = "String strLogo = request.getParameter"
        $var2 = "String content = request.getParameter(\"content\");"
        $var3 = "String basePath=request.getScheme()"
        $var4 = "!strLogo.equals("
        $var5 = "if(path!=null && !path.equals(\"\") && content!=null"
        $var6 = "File newfile=new File(path);"

        $str1 = "Save Success!"
        $str2 = "Save Failed!"

    condition:
        2 of ($var*) or (all of ($str*) and 1 of ($var*))
}
YARA Detection Rule: SUSP_ELF_LNX_UPX_Compressed_File
Repository: Neo23x0/signature-base
Detects: Detects a suspicious ELF binary with UPX compression
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "PROT_EXEC|PROT_WRITE failed." fullword ascii
      $s2 = "$Id: UPX" fullword ascii
      $s3 = "$Info: This file is packed with the UPX executable packer" ascii

      $fp1 = "check your UCL installation !"

Detection condition:
uint16(0) == 0x457f and filesize < 2000KB and
      filesize > 30KB and 2 of ($s*)
      and not 1 of ($fp*)

Full rule:
rule SUSP_ELF_LNX_UPX_Compressed_File {
   meta:
      description = "Detects a suspicious ELF binary with UPX compression"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2018-12-12"
      score = 40
      hash1 = "038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4"
      id = "078937de-59b3-538e-a5c3-57f4e6050212"
   strings:
      $s1 = "PROT_EXEC|PROT_WRITE failed." fullword ascii
      $s2 = "$Id: UPX" fullword ascii
      $s3 = "$Info: This file is packed with the UPX executable packer" ascii

      $fp1 = "check your UCL installation !"
   condition:
      uint16(0) == 0x457f and filesize < 2000KB and
      filesize > 30KB and 2 of ($s*)
      and not 1 of ($fp*)
}
YARA Detection Rule: HDRoot_Sample_Jul17_1
Repository: Neo23x0/signature-base
Detects: Detects HDRoot samples
Author: Florian Roth (Nextron Systems)
Reference: Winnti HDRoot VT

Pattern signatures:
$s1 = "gleupdate.dll" fullword ascii
      $s2 = "\\DosDevices\\%ws\\system32\\%ws" wide
      $s3 = "l\\Driver\\nsiproxy" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 60KB and 3 of them )

Full rule:
rule HDRoot_Sample_Jul17_1 {
   meta:
      description = "Detects HDRoot samples"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Winnti HDRoot VT"
      date = "2017-07-07"
      hash1 = "6d2ad82f455becc8c830d000633a370857928c584246a7f41fe722cc46c0d113"
      id = "06356f8a-bacd-51bc-a6f4-107983a9c16e"
   strings:
      $s1 = "gleupdate.dll" fullword ascii
      $s2 = "\\DosDevices\\%ws\\system32\\%ws" wide
      $s3 = "l\\Driver\\nsiproxy" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 60KB and 3 of them )
}
YARA Detection Rule: Unspecified_Malware_Jul17_1A
Repository: Neo23x0/signature-base
Detects: Detects samples of an unspecified malware - July 2017
Author: Florian Roth (Nextron Systems)
Reference: Winnti HDRoot VT

Pattern signatures:
$s1 = "%SystemRoot%\\System32\\wuauserv.dll" fullword ascii
      $s2 = "systemroot%\\system32\\wuauserv.dll" fullword ascii
      $s3 = "ocgen.logIN" fullword wide
      $s4 = "ocmsn.logIN" fullword wide
      $s5 = "Install.log" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 900KB and all of them )

Full rule:
rule Unspecified_Malware_Jul17_1A {
   meta:
      description = "Detects samples of an unspecified malware - July 2017"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Winnti HDRoot VT"
      date = "2017-07-07"
      hash1 = "e1c38142b6194237a4cd4603829aa6edb6436e7bba15e3e6b0c9e8c6b629b42b"
      id = "348515d5-784f-519d-b426-87b8a53de5f3"
   strings:
      $s1 = "%SystemRoot%\\System32\\wuauserv.dll" fullword ascii
      $s2 = "systemroot%\\system32\\wuauserv.dll" fullword ascii
      $s3 = "ocgen.logIN" fullword wide
      $s4 = "ocmsn.logIN" fullword wide
      $s5 = "Install.log" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 900KB and all of them )
}
YARA Detection Rule: APT_Sandworm_CyclopsBlink_notable_strings
Repository: Neo23x0/signature-base
Detects: Detects notable strings identified within the Cyclops Blink executable
Author: NCSC
Reference: https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter

Pattern signatures:
// Process names masqueraded by implant
      $proc_name1 = "[kworker/0:1]"
      $proc_name2 = "[kworker/1:1]"
      // DNS query over SSL, used to resolve C2 server address
      $dns_query = "POST /dns-query HTTP/1.1\x0d\x0aHost: dns.google\x0d\x0a"
      // iptables commands
      $iptables1 = "iptables -I %s -p tcp --dport %d -j ACCEPT &>/dev/null"
      $iptables2 = "iptables -D %s -p tcp --dport %d -j ACCEPT &>/dev/null"
      // Format strings used for system recon
      $sys_recon1 = "{\"ver\":\"%x\",\"mods\";["
      $sys_recon2 = "uptime: %lu mem_size: %lu mem_free: %lu"
      $sys_recon3 = "disk_size: %lu disk_free: %lu"
      $sys_recon4 = "hw: %02x:%02x:%02x:%02x:%02x:%02x"
      // Format string for filepath used to test access to device filesystem
      $testpath = "%s/214688dsf46"
      // Format string for implant configuration filepath
      $confpath = "%s/rootfs_cfg"
      // Default file download path
      $downpath = "/var/tmp/a.tmp"

Detection condition:
(uint32(0) == 0x464c457f) and (8 of them)

Full rule:
rule APT_Sandworm_CyclopsBlink_notable_strings {
   meta:
      author = "NCSC"
      description = "Detects notable strings identified within the Cyclops Blink executable"
      hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
      hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
      reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
      date = "2022-02-23"
      id = "81ccf582-41f5-5fe5-8afc-e008e01289ff"
   strings:
      // Process names masqueraded by implant
      $proc_name1 = "[kworker/0:1]"
      $proc_name2 = "[kworker/1:1]"
      // DNS query over SSL, used to resolve C2 server address
      $dns_query = "POST /dns-query HTTP/1.1\x0d\x0aHost: dns.google\x0d\x0a"
      // iptables commands
      $iptables1 = "iptables -I %s -p tcp --dport %d -j ACCEPT &>/dev/null"
      $iptables2 = "iptables -D %s -p tcp --dport %d -j ACCEPT &>/dev/null"
      // Format strings used for system recon
      $sys_recon1 = "{\"ver\":\"%x\",\"mods\";["
      $sys_recon2 = "uptime: %lu mem_size: %lu mem_free: %lu"
      $sys_recon3 = "disk_size: %lu disk_free: %lu"
      $sys_recon4 = "hw: %02x:%02x:%02x:%02x:%02x:%02x"
      // Format string for filepath used to test access to device filesystem
      $testpath = "%s/214688dsf46"
      // Format string for implant configuration filepath
      $confpath = "%s/rootfs_cfg"
      // Default file download path
      $downpath = "/var/tmp/a.tmp"
   condition:
      (uint32(0) == 0x464c457f) and (8 of them)
}
YARA Detection Rule: APT_Sandworm_CyclopsBlink_module_initialisation
Repository: Neo23x0/signature-base
Detects: Detects the code bytes used to initialise the modules built into Cyclops Blink
Author: NCSC
Reference: https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter

Pattern signatures:
// Module initialisation code bytes, simply returning the module ID
      // to the caller
      $ = {94 21 FF F0 93 E1 00 08 7C 3F 0B 78 38 00 00 ?? 7C 03
      03 78 81 61 00 00 8E EB FF F8 7D 61 5B 78 4E 80 00 20}

Detection condition:
(uint32(0) == 0x464c457f) and (any of them)

Full rule:
rule APT_Sandworm_CyclopsBlink_module_initialisation {
   meta:
      author = "NCSC"
      description = "Detects the code bytes used to initialise the modules built into Cyclops Blink"
      hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
      hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
      reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
      date = "2022-02-23"
      id = "c81b92c4-3f70-5bbd-acfa-ed1e1d33461d"
   strings:
      // Module initialisation code bytes, simply returning the module ID
      // to the caller
      $ = {94 21 FF F0 93 E1 00 08 7C 3F 0B 78 38 00 00 ?? 7C 03
      03 78 81 61 00 00 8E EB FF F8 7D 61 5B 78 4E 80 00 20}
   condition:
      (uint32(0) == 0x464c457f) and (any of them)
}
YARA Detection Rule: APT_Sandworm_CyclopsBlink_modified_install_upgrade
Repository: Neo23x0/signature-base
Detects: Detects notable strings identified within the modified install_upgrade executable, embedded within Cyclops Blink
Author: NCSC
Reference: https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter

Pattern signatures:
// Format strings used for temporary filenames
      $ = "/pending/%010lu_%06d_%03d_p1"
      $ = "/pending/sysa_code_dir/test_%d_%d_%d_%d_%d_%d"
      // Hard-coded key used to initialise HMAC calculation
      $ = "etaonrishdlcupfm"
      // Filepath used to store the patched firmware image
      $ = "/pending/WGUpgrade-dl.new"
      // Filepath of legitimate install_upgrade executable
      $ = "/pending/bin/install_upgraded"
      // Loop device IOCTL LOOP_SET_FD
      $ = {38 80 4C 00}
      // Loop device IOCTL LOOP_GET_STATUS64
      $ = {38 80 4C 05}
      // Loop device IOCTL LOOP_SET_STATUS64
      $ = {38 80 4C 04}
      // Firmware HMAC record starts with the string "HMAC"
      $ = {3C 00 48 4D 60 00 41 43 90 09 00 00}

Detection condition:
(uint32(0) == 0x464c457f) and (6 of them)

Full rule:
rule APT_Sandworm_CyclopsBlink_modified_install_upgrade {
   meta:
      author = "NCSC"
      description = "Detects notable strings identified within the modified install_upgrade executable, embedded within Cyclops Blink"
      hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
      hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
      hash3 = "7d61c0dd0cd901221a9dff9df09bb90810754f10"
      hash4 = "438cd40caca70cafe5ca436b36ef7d3a6321e858"
      reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
      date = "2022-02-23"
      id = "4c4f7262-df74-5f6a-afc0-df1fcae4741c"
   strings:
      // Format strings used for temporary filenames
      $ = "/pending/%010lu_%06d_%03d_p1"
      $ = "/pending/sysa_code_dir/test_%d_%d_%d_%d_%d_%d"
      // Hard-coded key used to initialise HMAC calculation
      $ = "etaonrishdlcupfm"
      // Filepath used to store the patched firmware image
      $ = "/pending/WGUpgrade-dl.new"
      // Filepath of legitimate install_upgrade executable
      $ = "/pending/bin/install_upgraded"
      // Loop device IOCTL LOOP_SET_FD
      $ = {38 80 4C 00}
      // Loop device IOCTL LOOP_GET_STATUS64
      $ = {38 80 4C 05}
      // Loop device IOCTL LOOP_SET_STATUS64
      $ = {38 80 4C 04}
      // Firmware HMAC record starts with the string "HMAC"
      $ = {3C 00 48 4D 60 00 41 43 90 09 00 00}
   condition:
      (uint32(0) == 0x464c457f) and (6 of them)
}
YARA Detection Rule: APT_Sandworm_CyclopsBlink_core_command_check
Repository: Neo23x0/signature-base
Detects: Detects the code bytes used to test the command ID being sent to the core component of Cyclops Blink
Author: NCSC
Reference: https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter

Pattern signatures:
// Check for command ID equals 0x7, 0xa, 0xb, 0xc or 0xd
      $cmd_check = {81 3F 00 18 88 09 00 05 54 00 06 3E 2F 80 00 (07|0A|0B|0C|0D) }

Detection condition:
(uint32(0) == 0x464c457f) and (#cmd_check == 5)

Full rule:
rule APT_Sandworm_CyclopsBlink_core_command_check {
   meta:
      author = "NCSC"
      description = "Detects the code bytes used to test the command ID being sent to the core component of Cyclops Blink"
      hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
      hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
      reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
      date = "2022-02-23"
      id = "46[PII_REDACTED]-52fb-b40d-30ff8e285b6e"
   strings:
      // Check for command ID equals 0x7, 0xa, 0xb, 0xc or 0xd
      $cmd_check = {81 3F 00 18 88 09 00 05 54 00 06 3E 2F 80 00 (07|0A|0B|0C|0D) }
   condition:
      (uint32(0) == 0x464c457f) and (#cmd_check == 5)
}
YARA Detection Rule: APT_Sandworm_CyclopsBlink_config_identifiers
Repository: Neo23x0/signature-base
Detects: Detects the initial characters used to identify Cyclops Blink configuration data
Author: NCSC
Reference: https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter

Pattern signatures:
// Main config parameter data starts with the string "<p: "
      //$ = "<p: " fullword  // short atom - not necessary
      // RSA public key data starts with the string "<k: "
      $ = {3C 00 3C 6B 60 00 3A 20 90 09 00 00}
      // X.509 certificate data starts with the string "<c: "
      $ = {3C 00 3C 63 60 00 3A 20 90 09 00 00}
      // RSA private key data starts with the string "<s: "
      $ = {3C 00 3C 73 60 00 3A 20 90 09 00 00}

Detection condition:
(uint32(0) == 0x464c457f) and (all of them)

Full rule:
rule APT_Sandworm_CyclopsBlink_config_identifiers {
   meta:
      author = "NCSC"
      description = "Detects the initial characters used to identify Cyclops Blink configuration data"
      hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
      hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
      reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
      date = "2022-02-23"
      id = "db5b3a4a-82c2-500a-88f6-340b3392eac8"
   strings:
      // Main config parameter data starts with the string "<p: "
      //$ = "<p: " fullword  // short atom - not necessary
      // RSA public key data starts with the string "<k: "
      $ = {3C 00 3C 6B 60 00 3A 20 90 09 00 00}
      // X.509 certificate data starts with the string "<c: "
      $ = {3C 00 3C 63 60 00 3A 20 90 09 00 00}
      // RSA private key data starts with the string "<s: "
      $ = {3C 00 3C 73 60 00 3A 20 90 09 00 00}
   condition:
      (uint32(0) == 0x464c457f) and (all of them)
}
YARA Detection Rule: APT_Sandworm_CyclopsBlink_handle_mod_0xf_command
Repository: Neo23x0/signature-base
Detects: Detects the code bytes used to check module ID 0xf control flags and a format string used for file content upload
Author: NCSC
Reference: https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter

Pattern signatures:
// Tests execute flag (bit 0)
      $ = {54 00 06 3E 54 00 07 FE 54 00 06 3E 2F 80 00 00}
      // Tests add module flag (bit 1)
      $ = {54 00 06 3E 54 00 07 BC 2F 80 00 00}
      // Tests run as shellcode flag (bit 2)
      $ = {54 00 06 3E 54 00 07 7A 2F 80 00 00}
      // Tests upload flag (bit 4)
      $ = {54 00 06 3E 54 00 06 F6 2F 80 00 00}
      // Upload format string
      $ = "file:%s\n" fullword

Detection condition:
(uint32(0) == 0x464c457f) and (all of them)

Full rule:
rule APT_Sandworm_CyclopsBlink_handle_mod_0xf_command {
   meta:
      author = "NCSC"
      description = "Detects the code bytes used to check module ID 0xf control flags and a format string used for file content upload"
      hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
      hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
      reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
      date = "2022-02-23"
      id = "36646b7a-389d-5fd9-88a1-e43e7224763a"
   strings:
      // Tests execute flag (bit 0)
      $ = {54 00 06 3E 54 00 07 FE 54 00 06 3E 2F 80 00 00}
      // Tests add module flag (bit 1)
      $ = {54 00 06 3E 54 00 07 BC 2F 80 00 00}
      // Tests run as shellcode flag (bit 2)
      $ = {54 00 06 3E 54 00 07 7A 2F 80 00 00}
      // Tests upload flag (bit 4)
      $ = {54 00 06 3E 54 00 06 F6 2F 80 00 00}
      // Upload format string
      $ = "file:%s\n" fullword
   condition:
      (uint32(0) == 0x464c457f) and (all of them)
}
YARA Detection Rule: APT_Sandworm_CyclopsBlink_default_config_values
Repository: Neo23x0/signature-base
Detects: Detects the code bytes used to set default Cyclops Blink configuration values
Author: NCSC
Reference: https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter

Pattern signatures:
// Unknown config value set to 0x19
      $ = {38 00 00 19 90 09 01 A4}
      // Unknown config value set to 0x18000
      $ = {3C 00 00 01 60 00 80 00 90 09 01 A8}
      // Unknown config value set to 0x4000
      $ = {38 00 40 00 90 09 01 AC}
      // Unknown config value set to 0x10b
      $ = {38 00 01 0B 90 09 01 B0}
      // Unknown config value set to 0x2711
      $ = {38 00 27 11 90 09 01 C0}

Detection condition:
(uint32(0) == 0x464c457f) and (3 of them)

Full rule:
rule APT_Sandworm_CyclopsBlink_default_config_values {
   meta:
      author = "NCSC"
      description = "Detects the code bytes used to set default Cyclops Blink configuration values"
      hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
      hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
      reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
      date = "2022-02-23"
      id = "04[PII_REDACTED]-51f2-907f-2a236aae6c7c"
   strings:
      // Unknown config value set to 0x19
      $ = {38 00 00 19 90 09 01 A4}
      // Unknown config value set to 0x18000
      $ = {3C 00 00 01 60 00 80 00 90 09 01 A8}
      // Unknown config value set to 0x4000
      $ = {38 00 40 00 90 09 01 AC}
      // Unknown config value set to 0x10b
      $ = {38 00 01 0B 90 09 01 B0}
      // Unknown config value set to 0x2711
      $ = {38 00 27 11 90 09 01 C0}
   condition:
      (uint32(0) == 0x464c457f) and (3 of them)
}
YARA Detection Rule: APT_Sandworm_CyclopsBlink_handle_mod_0x51_command
Repository: Neo23x0/signature-base
Detects: Detects the code bytes used to check commands sent to module ID 0x51 and notable strings relating to the Cyclops Blink update process
Author: NCSC
Reference: https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter

Pattern signatures:
// Check for module command ID equals 0x1, 0x2 or 0x3
      $cmd_check = {88 1F [2] 54 00 06 3E 2F 80 00 (01|02|03) }
      // Legitimate WatchGuard filepaths relating to device configuration
      $path1 = "/etc/wg/configd-hash.xml"
      $path2 = "/etc/wg/config.xml"
      // Mount arguments used to remount root filesystem as RW or RO
      $mnt_arg1 = "ext2"
      $mnt_arg2 = "errors=continue"
      $mnt_arg3 = {38 C0 0C 20}
      $mnt_arg4 = {38 C0 0C 21}

Detection condition:
(uint32(0) == 0x464c457f) and (#cmd_check == 3) and
      ((@cmd_check[3] - @cmd_check[1]) < 0x200) and
      (all of ($path*)) and (all of ($mnt_arg*))

Full rule:
rule APT_Sandworm_CyclopsBlink_handle_mod_0x51_command {
   meta:
      author = "NCSC"
      description = "Detects the code bytes used to check commands sent to module ID 0x51 and notable strings relating to the Cyclops Blink update process"
      hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
      hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
      reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
      date = "2022-02-23"
      id = "a6800aed-27dc-5d01-b005-1eb4a62344a3"
   strings:
      // Check for module command ID equals 0x1, 0x2 or 0x3
      $cmd_check = {88 1F [2] 54 00 06 3E 2F 80 00 (01|02|03) }
      // Legitimate WatchGuard filepaths relating to device configuration
      $path1 = "/etc/wg/configd-hash.xml"
      $path2 = "/etc/wg/config.xml"
      // Mount arguments used to remount root filesystem as RW or RO
      $mnt_arg1 = "ext2"
      $mnt_arg2 = "errors=continue"
      $mnt_arg3 = {38 C0 0C 20}
      $mnt_arg4 = {38 C0 0C 21}
   condition:
      (uint32(0) == 0x464c457f) and (#cmd_check == 3) and
      ((@cmd_check[3] - @cmd_check[1]) < 0x200) and
      (all of ($path*)) and (all of ($mnt_arg*))
}
YARA Detection Rule: Exp_EPS_CVE20152545
Repository: Neo23x0/signature-base
Detects: Detects EPS Word Exploit CVE-2015-2545
Author: Florian Roth (Nextron Systems)
Reference: Internal Research - ME

Pattern signatures:
$s1 = "word/media/image1.eps" ascii
      $s2 = "-la;7(la+" ascii

Detection condition:
uint16(0) == 0x4b50 and ( $s1 and #s2 > 20 )

Full rule:
rule Exp_EPS_CVE20152545 {
   meta:
      description = "Detects EPS Word Exploit CVE-2015-2545"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research - ME"
      date = "2017-07-19"
      score = 70
      id = "9a5f0554-b588-5b82-93df-0fdfba2af2da"
   strings:
      $s1 = "word/media/image1.eps" ascii
      $s2 = "-la;7(la+" ascii
   condition:
      uint16(0) == 0x4b50 and ( $s1 and #s2 > 20 )
}