deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Disclosed_0day_POCs_injector
Repository: Neo23x0/signature-base
Detects: Detects POC code from disclosed 0day hacktool set
Author: Florian Roth (Nextron Systems)
Reference: Disclosed 0day Repos

Pattern signatures:
$x1 = "\\Release\\injector.pdb" ascii
      $x2 = "Cannot write the shellcode in the process memory, error: " fullword ascii
      $x3 = "/s shellcode_file PID: shellcode injection." fullword ascii
      $x4 = "/d dll_file PID: dll injection via LoadLibrary()." fullword ascii
      $x5 = "/s shellcode_file PID" fullword ascii
      $x6 = "Shellcode copied in memory: OK" fullword ascii
      $x7 = "Usage of the injector. " fullword ascii
      $x8 = "KO: cannot obtain the SeDebug privilege." fullword ascii

Detection condition:
(uint16(0) == 0x5a4d and filesize < 90KB and 1 of them) or 3 of them

Full rule:
rule Disclosed_0day_POCs_injector {
   meta:
      description = "Detects POC code from disclosed 0day hacktool set"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Disclosed 0day Repos"
      date = "2017-07-07"
      hash1 = "ba0e2119b2a6bad612e86662b643a404426a07444d476472a71452b7e9f94041"
      id = "6de89a84-fe16-5064-8cbb-a3b9003f4c0c"
   strings:
      $x1 = "\\Release\\injector.pdb" ascii
      $x2 = "Cannot write the shellcode in the process memory, error: " fullword ascii
      $x3 = "/s shellcode_file PID: shellcode injection." fullword ascii
      $x4 = "/d dll_file PID: dll injection via LoadLibrary()." fullword ascii
      $x5 = "/s shellcode_file PID" fullword ascii
      $x6 = "Shellcode copied in memory: OK" fullword ascii
      $x7 = "Usage of the injector. " fullword ascii
      $x8 = "KO: cannot obtain the SeDebug privilege." fullword ascii
   condition:
      (uint16(0) == 0x5a4d and filesize < 90KB and 1 of them) or 3 of them
}
YARA Detection Rule: Disclosed_0day_POCs_lpe_2
Repository: Neo23x0/signature-base
Detects: Detects POC code from disclosed 0day hacktool set
Author: Florian Roth (Nextron Systems)
Reference: Disclosed 0day Repos

Pattern signatures:
$s1 = "\\cmd.exe\" /k wusa c:\\users\\" ascii
      $s2 = "D:\\gitpoc\\UAC\\src\\x64\\Release\\lpe.pdb" fullword ascii
      $s3 = "Folder Created: " fullword wide

Detection condition:
(uint16(0) == 0x5a4d and filesize < 700KB and 2 of them)

Full rule:
rule Disclosed_0day_POCs_lpe_2 {
   meta:
      description = "Detects POC code from disclosed 0day hacktool set"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Disclosed 0day Repos"
      date = "2017-07-07"
      hash1 = "b4f3787a19b71c47bc4357a5a77ffb456e2f71fd858079d93e694a6a79f66533"
      id = "9326bbae-81ee-588e-8581-628b47d348f8"
   strings:
      $s1 = "\\cmd.exe\" /k wusa c:\\users\\" ascii
      $s2 = "D:\\gitpoc\\UAC\\src\\x64\\Release\\lpe.pdb" fullword ascii
      $s3 = "Folder Created: " fullword wide
   condition:
      (uint16(0) == 0x5a4d and filesize < 700KB and 2 of them)
}
YARA Detection Rule: Disclosed_0day_POCs_shellcodegenerator
Repository: Neo23x0/signature-base
Detects: Detects POC code from disclosed 0day hacktool set
Author: Florian Roth (Nextron Systems)
Reference: Disclosed 0day Repos

Pattern signatures:
$x1 = "\\Release\\shellcodegenerator.pdb" ascii

Detection condition:
(uint16(0) == 0x5a4d and filesize < 40KB and all of them)

Full rule:
rule Disclosed_0day_POCs_shellcodegenerator {
   meta:
      description = "Detects POC code from disclosed 0day hacktool set"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Disclosed 0day Repos"
      date = "2017-07-07"
      hash1 = "55c4073bf8d38df7d392aebf9aed2304109d92229971ffac6e1c448986a87916"
      id = "49250cbe-7bbd-5462-9324-1a8f350386f3"
   strings:
      $x1 = "\\Release\\shellcodegenerator.pdb" ascii
   condition:
      (uint16(0) == 0x5a4d and filesize < 40KB and all of them)
}
YARA Detection Rule: SecurityXploded_Producer_String
Repository: Neo23x0/signature-base
Detects: Detects hacktools by SecurityXploded
Author: Florian Roth (Nextron Systems)
Reference: http://securityxploded.com/browser-password-dump.php

Pattern signatures:
$x1 = "http://securityxploded.com" fullword ascii

Detection condition:
(uint16(0) == 0x5a4d and all of them)

Full rule:
rule SecurityXploded_Producer_String {
   meta:
      description = "Detects hacktools by SecurityXploded"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://securityxploded.com/browser-password-dump.php"
      date = "2017-07-13"
      score = 60
      hash1 = "d57847db5458acabc87daee6f30173348ac5956eb25e6b845636e25f5a56ac59"
      id = "739c4ba1-5126-51cc-a2dd-cdac2737e29a"
   strings:
      $x1 = "http://securityxploded.com" fullword ascii
   condition:
      (uint16(0) == 0x5a4d and all of them)
}
YARA Detection Rule: Kekeo_Hacktool
Repository: Neo23x0/signature-base
Detects: Detects Kekeo Hacktool
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/gentilkiwi/kekeo/releases

Pattern signatures:
$x1 = "[ticket %u] session Key is NULL, maybe a TGT without enough rights when WCE dumped it." fullword wide
      $x2 = "ERROR kuhl_m_smb_time ; Invalid! Command: %02x - Status: %08x" fullword wide

Detection condition:
(uint16(0) == 0x5a4d and filesize < 2000KB and (1 of ($x*)))

Full rule:
rule Kekeo_Hacktool {
   meta:
      description = "Detects Kekeo Hacktool"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/gentilkiwi/kekeo/releases"
      date = "2017-07-21"
      hash1 = "ce92c0bcdf63347d84824a02b7a448cf49dd9f44db2d02722d01c72556a2b767"
      hash2 = "49d7fec5feff20b3b57b26faccd50bc05c71f1dddf5800eb4abaca14b83bba8c"
      id = "a4158da8-fc4d-5dc6-b44c-f5325b3bb8ca"
   strings:
      $x1 = "[ticket %u] session Key is NULL, maybe a TGT without enough rights when WCE dumped it." fullword wide
      $x2 = "ERROR kuhl_m_smb_time ; Invalid! Command: %02x - Status: %08x" fullword wide
   condition:
      (uint16(0) == 0x5a4d and filesize < 2000KB and (1 of ($x*)))
}
YARA Detection Rule: AllTheThings
Repository: Neo23x0/signature-base
Detects: Detects AllTheThings
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/subTee/AllTheThings

Pattern signatures:
$x1 = "\\obj\\Debug\\AllTheThings.pdb" ascii
      $x2 = "AllTheThings.exe" fullword wide
      $x3 = "\\AllTheThings.dll" ascii
      $x4 = "Hello From Main...I Don't Do Anything" fullword wide
      $x5 = "I am a basic COM Object" fullword wide
      $x6 = "I shouldn't really execute either." fullword wide

Detection condition:
(uint16(0) == 0x5a4d and filesize < 50KB and 1 of them)

Full rule:
rule AllTheThings {
   meta:
      description = "Detects AllTheThings"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/subTee/AllTheThings"
      date = "2017-07-27"
      modified = "2022-12-21"
      hash1 = "5a0e9a9ce00d843ea95bd5333b6ab50cc5b1dbea648cc819cfe48482513ce842"
      id = "c3169ca7-3482-5d55-a1d9-6d1c01349922"
   strings:
      $x1 = "\\obj\\Debug\\AllTheThings.pdb" ascii
      $x2 = "AllTheThings.exe" fullword wide
      $x3 = "\\AllTheThings.dll" ascii
      $x4 = "Hello From Main...I Don't Do Anything" fullword wide
      $x5 = "I am a basic COM Object" fullword wide
      $x6 = "I shouldn't really execute either." fullword wide
   condition:
      (uint16(0) == 0x5a4d and filesize < 50KB and 1 of them)
}
YARA Detection Rule: Impacket_Keyword
Repository: Neo23x0/signature-base
Detects: Detects Impacket Keyword in Executable
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "impacket.smb(" ascii
      $s2 = "impacket.ntlm(" ascii
      $s3 = "impacket.nmb(" ascii

Detection condition:
(uint16(0) == 0x5a4d and filesize < 14000KB and 1 of them)

Full rule:
rule Impacket_Keyword {
   meta:
      description = "Detects Impacket Keyword in Executable"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-08-04"
      score = 60
      hash1 = "9388c78ea6a78dbea307470c94848ae2481481f593d878da7763e649eaab4068"
      hash2 = "2f6d95e0e15174cfe8e30aaa2c53c74fdd13f9231406b7103da1e099c08be409"
      id = "a92962e6-1b05-583b-8b06-f226bdea88e2"
   strings:
      $s1 = "impacket.smb(" ascii
      $s2 = "impacket.ntlm(" ascii
      $s3 = "impacket.nmb(" ascii
   condition:
      (uint16(0) == 0x5a4d and filesize < 14000KB and 1 of them)
}
YARA Detection Rule: PasswordsPro
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file PasswordsPro.exe
Author: Florian Roth (Nextron Systems)
Reference: PasswordPro

Pattern signatures:
$s1 = "No users marked for attack or all marked users already have passwords found!" fullword ascii
      $s2 = "%s\\PasswordsPro.ini.Dictionaries(%d)" fullword ascii
      $s3 = "Passwords processed since attack start:" fullword ascii

Detection condition:
(uint16(0) == 0x5a4d and
         filesize < 2000KB and
         1 of them
      )

Full rule:
rule PasswordsPro {
   meta:
      description = "Auto-generated rule - file PasswordsPro.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "PasswordPro"
      date = "2017-08-27"
      hash1 = "5b3d6654e6d9dc49ee1136c0c8e8122cb0d284562447abfdc05dfe38c79f95bf"
      id = "c749f883-364e-5f65-9eb8-3dcd74495f7c"
   strings:
      $s1 = "No users marked for attack or all marked users already have passwords found!" fullword ascii
      $s2 = "%s\\PasswordsPro.ini.Dictionaries(%d)" fullword ascii
      $s3 = "Passwords processed since attack start:" fullword ascii
   condition:
      (uint16(0) == 0x5a4d and
         filesize < 2000KB and
         1 of them
      )
}
YARA Detection Rule: PasswordPro_NTLM_DLL
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file NTLM.dll
Author: Florian Roth (Nextron Systems)
Reference: PasswordPro

Pattern signatures:
$s1 = "NTLM.dll" fullword ascii
      $s2 = "Algorithm: NTLM" fullword ascii

Detection condition:
(uint16(0) == 0x5a4d and
         filesize < 20KB and
         pe.exports("GetHash") and pe.exports("GetInfo") and
         (all of them)
      )

Full rule:
rule PasswordPro_NTLM_DLL {
   meta:
      description = "Auto-generated rule - file NTLM.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "PasswordPro"
      date = "2017-08-27"
      hash1 = "47d4755d31bb96147e6230d8ea1ecc3065da8e557e8176435ccbcaea16fe50de"
      id = "cc86b868-000f-56b1-91cd-4aa8caace1df"
   strings:
      $s1 = "NTLM.dll" fullword ascii
      $s2 = "Algorithm: NTLM" fullword ascii
   condition:
      (uint16(0) == 0x5a4d and
         filesize < 20KB and
         pe.exports("GetHash") and pe.exports("GetInfo") and
         (all of them)
      )
}
YARA Detection Rule: KeeThief_PS
Repository: Neo23x0/signature-base
Detects: Detects component of KeeTheft - KeePass dump tool - file KeeThief.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/HarmJ0y/KeeThief

Pattern signatures:
$x1 = "$WMIProcess = Get-WmiObject win32_process -Filter \"ProcessID = $($KeePassProcess.ID)\"" fullword ascii
      $x2 = "if($KeePassProcess.FileVersion -match '^2\\.') {" fullword ascii

Detection condition:
(uint16(0) == 0x7223 and
         filesize < 1000KB and
         (1 of ($x*))
      )

Full rule:
rule KeeThief_PS {
   meta:
      description = "Detects component of KeeTheft - KeePass dump tool - file KeeThief.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/HarmJ0y/KeeThief"
      date = "2017-08-29"
      hash1 = "a3b976279ded8e64b548c1d487212b46b03aaec02cb6e199ea620bd04b8de42f"
      id = "9a54e8d1-3cae-51e8-8da0-024ac25dc6d0"
   strings:
      $x1 = "$WMIProcess = Get-WmiObject win32_process -Filter \"ProcessID = $($KeePassProcess.ID)\"" fullword ascii
      $x2 = "if($KeePassProcess.FileVersion -match '^2\\.') {" fullword ascii
   condition:
      (uint16(0) == 0x7223 and
         filesize < 1000KB and
         (1 of ($x*))
      )
}
YARA Detection Rule: KeeTheft_EXE
Repository: Neo23x0/signature-base
Detects: Detects component of KeeTheft - KeePass dump tool - file KeeTheft.exe
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/HarmJ0y/KeeThief

Pattern signatures:
$x1 = "Error: Could not create a thread for the shellcode" fullword wide
      $x2 = "Could not find address marker in shellcode" fullword wide
      $x3 = "GenerateDecryptionShellCode" fullword ascii
      $x4 = "KeePassLib.Keys.KcpPassword" fullword wide
      $x5 = "************ Found a CompositeKey! **********" fullword wide
      $x6 = "*** Interesting... there are multiple .NET runtimes loaded in KeePass" fullword wide
      $x7 = "GetKcpPasswordInfo" fullword ascii

Detection condition:
(uint16(0) == 0x5a4d and filesize < 200KB and 2 of them)

Full rule:
rule KeeTheft_EXE {
   meta:
      description = "Detects component of KeeTheft - KeePass dump tool - file KeeTheft.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/HarmJ0y/KeeThief"
      date = "2017-08-29"
      hash1 = "f06789c3e9fe93c[PII_REDACTED]8e59dda6b10331b931601c2b5ae06ede41dc22"
      id = "65531239-c5fa-5285-8f44-2d858e211c9b"
   strings:
      $x1 = "Error: Could not create a thread for the shellcode" fullword wide
      $x2 = "Could not find address marker in shellcode" fullword wide
      $x3 = "GenerateDecryptionShellCode" fullword ascii
      $x4 = "KeePassLib.Keys.KcpPassword" fullword wide
      $x5 = "************ Found a CompositeKey! **********" fullword wide
      $x6 = "*** Interesting... there are multiple .NET runtimes loaded in KeePass" fullword wide
      $x7 = "GetKcpPasswordInfo" fullword ascii
   condition:
      (uint16(0) == 0x5a4d and filesize < 200KB and 2 of them)
}
YARA Detection Rule: KeeTheft_Out_Shellcode
Repository: Neo23x0/signature-base
Detects: Detects component of KeeTheft - KeePass dump tool - file Out-Shellcode.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/HarmJ0y/KeeThief

Pattern signatures:
$x1 = "Write-Host \"Shellcode length: 0x$(($ShellcodeLength + 1).ToString('X4'))\"" fullword ascii
      $x2 = "$TextSectionInfo = @($MapContents | Where-Object { $_ -match '\\.text\\W+CODE' })[0]" fullword ascii

Detection condition:
(filesize < 2KB and 1 of them)

Full rule:
rule KeeTheft_Out_Shellcode {
   meta:
      description = "Detects component of KeeTheft - KeePass dump tool - file Out-Shellcode.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/HarmJ0y/KeeThief"
      date = "2017-08-29"
      hash1 = "2afb1c8c82363a0ae43cad9d448dd20bb7d2762aa5ed3672cd8e14dee568e16b"
      id = "1263ad5d-5d50-50e6-ad78-9d5e4e16634b"
   strings:
      $x1 = "Write-Host \"Shellcode length: 0x$(($ShellcodeLength + 1).ToString('X4'))\"" fullword ascii
      $x2 = "$TextSectionInfo = @($MapContents | Where-Object { $_ -match '\\.text\\W+CODE' })[0]" fullword ascii
   condition:
      (filesize < 2KB and 1 of them)
}
YARA Detection Rule: Sharpire
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file Sharpire.exe
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/0xbadjuju/Sharpire

Pattern signatures:
$x1 = "\\obj\\Debug\\Sharpire.pdb" ascii
      $x2 = "[*] Upload of $fileName successful" fullword wide

      $s1 = "no shell command supplied" fullword wide
      $s2 = "/login/process.php" fullword wide
      $s3 = "invokeShellCommand" fullword ascii
      $s4 = "..Command execution completed." fullword wide
      $s5 = "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" fullword wide
      $s6 = "/admin/get.php" fullword wide
      $s7 = "[!] Error in stopping job: " fullword wide

Detection condition:
(uint16(0) == 0x5a4d and filesize < 100KB and (1 of ($x*) and 3 of them))

Full rule:
rule Sharpire {
   meta:
      description = "Auto-generated rule - file Sharpire.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/0xbadjuju/Sharpire"
      date = "2017-09-23"
      modified = "2022-12-21"
      hash1 = "327a1dc2876cd9d7f6a5b[PII_REDACTED]296fc809d466e42861adcf09986c6e587"
      id = "747f2798-4f93-5073-b358-969060a1c937"
   strings:
      $x1 = "\\obj\\Debug\\Sharpire.pdb" ascii
      $x2 = "[*] Upload of $fileName successful" fullword wide

      $s1 = "no shell command supplied" fullword wide
      $s2 = "/login/process.php" fullword wide
      $s3 = "invokeShellCommand" fullword ascii
      $s4 = "..Command execution completed." fullword wide
      $s5 = "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" fullword wide
      $s6 = "/admin/get.php" fullword wide
      $s7 = "[!] Error in stopping job: " fullword wide
   condition:
      (uint16(0) == 0x5a4d and filesize < 100KB and (1 of ($x*) and 3 of them))
}
YARA Detection Rule: Invoke_Metasploit
Repository: Neo23x0/signature-base
Detects: Detects Invoke-Metasploit Payload
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/jaredhaight/Invoke-MetasploitPayload/blob/master/Invoke-MetasploitPayload.ps1

Pattern signatures:
$s1 = "[*] Looks like we're 64bit, using regular powershell.exe" ascii wide
      $s2 = "[*] Kicking off download cradle in a new process"
      $s3 = "Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;Invoke-Expression $client.downloadstring('''+$url+''');'"

Detection condition:
(filesize < 20KB and 1 of them)

Full rule:
rule Invoke_Metasploit {
   meta:
      description = "Detects Invoke-Metasploit Payload"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/jaredhaight/Invoke-MetasploitPayload/blob/master/Invoke-MetasploitPayload.ps1"
      date = "2017-09-23"
      hash1 = "b36d3ca7073741c8a48c578edaa6d3b6a8c3c4413e961a83ad08ad128b843e0b"
      id = "40452884-df3f-5b49-ad10-05006cb115f2"
   strings:
      $s1 = "[*] Looks like we're 64bit, using regular powershell.exe" ascii wide
      $s2 = "[*] Kicking off download cradle in a new process"
      $s3 = "Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;Invoke-Expression $client.downloadstring('''+$url+''');'"
   condition:
      (filesize < 20KB and 1 of them)
}
YARA Detection Rule: PowerShell_Mal_HackTool_Gen
Repository: Neo23x0/signature-base
Detects: Detects PowerShell hack tool samples - generic PE loader
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "$PEBytes32 = 'TVqQAAMAAAAEAAAA" wide
      $x2 = "Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineWAddrTemp" fullword wide
      $x3 = "@($PEBytes64, $PEBytes32, \"Void\", 0, \"\", $ExeArgs)" fullword wide
      $x4 = "(Shellcode: LoadLibraryA.asm)" fullword wide

Detection condition:
filesize < 8000KB and 1 of them

Full rule:
rule PowerShell_Mal_HackTool_Gen {
   meta:
      description = "Detects PowerShell hack tool samples - generic PE loader"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-11-02"
      hash1 = "d442304ca839d75b34e30e49a8b9437b5ab60b74d85ba[PII_REDACTED]ce7038b32"
      id = "d1fc4594-d816-5d02-bff6-3f220477b555"
   strings:
      $x1 = "$PEBytes32 = 'TVqQAAMAAAAEAAAA" wide
      $x2 = "Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineWAddrTemp" fullword wide
      $x3 = "@($PEBytes64, $PEBytes32, \"Void\", 0, \"\", $ExeArgs)" fullword wide
      $x4 = "(Shellcode: LoadLibraryA.asm)" fullword wide
   condition:
      filesize < 8000KB and 1 of them
}
YARA Detection Rule: Sig_RemoteAdmin_1
Repository: Neo23x0/signature-base
Detects: Detects strings from well-known APT malware
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$ = "Radmin, Remote Administrator" wide
      $ = "Radmin 3.0" wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 3000KB and 1 of them

Full rule:
rule Sig_RemoteAdmin_1 {
   meta:
      description = "Detects strings from well-known APT malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-12-03"
      score = 45
      id = "da55084c-ec1f-5800-a614-189dce7b5820"
   strings:
      $ = "Radmin, Remote Administrator" wide
      $ = "Radmin 3.0" wide
   condition:
      uint16(0) == 0x5a4d and filesize < 3000KB and 1 of them
}
YARA Detection Rule: RemCom_RemoteCommandExecution
Repository: Neo23x0/signature-base
Detects: Detects strings from RemCom tool
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tezXZt

Pattern signatures:
$ = "\\\\.\\pipe\\%s%s%d"
      $ = "%s\\pipe\\%s%s%d%s"
      $ = "\\ADMIN$\\System32\\%s%s"

Detection condition:
1 of them

Full rule:
rule RemCom_RemoteCommandExecution {
   meta:
      description = "Detects strings from RemCom tool"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tezXZt"
      date = "2017-12-28"
      score = 50
      id = "90b4ce3c-a690-5b6e-95e8-7e5dc8270152"
   strings:
      $ = "\\\\.\\pipe\\%s%s%d"
      $ = "%s\\pipe\\%s%s%d%s"
      $ = "\\ADMIN$\\System32\\%s%s"
   condition:
      1 of them
}
YARA Detection Rule: Crackmapexec_EXE
Repository: Neo23x0/signature-base
Detects: Detects CrackMapExec hack tool
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "core.scripts.secretsdump(" ascii
      $s2 = "core.scripts.samrdump(" ascii
      $s3 = "core.uacdump(" ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 10000KB and 2 of them

Full rule:
rule Crackmapexec_EXE {
   meta:
      description = "Detects CrackMapExec hack tool"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2018-04-06"
      score = 85
      hash1 = "371f104b7876b9080c[PII_REDACTED]35f36edb6668097de475949b84ab72ee9a9a"
      id = "9fcfba98-7ba1-5810-99b7-62ad2b1aa4c0"
   strings:
      $s1 = "core.scripts.secretsdump(" ascii
      $s2 = "core.scripts.samrdump(" ascii
      $s3 = "core.uacdump(" ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 10000KB and 2 of them
}