deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EquationDrug_NetworkSniffer5
Repository: Neo23x0/signature-base
Detects: EquationDrug - Network-sniffer/patcher - atmdkdrv.sys
Author: Florian Roth (Nextron Systems)
Reference: http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/

Pattern signatures:
$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
      $s1 = "\\Registry\\User\\CurrentUser\\" wide
      $s2 = "atmdkdrv.sys" fullword wide
      $s4 = "\\Device\\%ws_%ws" wide
      $s5 = "\\DosDevices\\%ws" wide
      $s6 = "\\Device\\%ws" wide

Detection condition:
all of them

Full rule:
rule EquationDrug_NetworkSniffer5 {
   meta:
      description = "EquationDrug - Network-sniffer/patcher - atmdkdrv.sys"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
      date = "2015/03/11"
      modified = "2023-01-06"
      hash = "09399b9bd600d4516db37307a457bc55eedcbd17"
      id = "9eac2c51-3ad7-5346-a985-39733bc204c2"
   strings:
      $s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
      $s1 = "\\Registry\\User\\CurrentUser\\" wide
      $s2 = "atmdkdrv.sys" fullword wide
      $s4 = "\\Device\\%ws_%ws" wide
      $s5 = "\\DosDevices\\%ws" wide
      $s6 = "\\Device\\%ws" wide
   condition:
      all of them
}
YARA Detection Rule: EquationDrug_FileSystem_Filter
Repository: Neo23x0/signature-base
Detects: EquationDrug - Filesystem filter driver - volrec.sys, scsi2mgr.sys
Author: Florian Roth (Nextron Systems) @4nc4p
Reference: http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/

Pattern signatures:
$s0 = "volrec.sys" fullword wide
		$s1 = "volrec.pdb" fullword ascii
		$s2 = "Volume recognizer driver" fullword wide

Detection condition:
all of them

Full rule:
rule EquationDrug_FileSystem_Filter {
	meta:
		description = "EquationDrug - Filesystem filter driver - volrec.sys, scsi2mgr.sys"
		author = "Florian Roth (Nextron Systems) @4nc4p"
		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
		date = "2015/03/11"
		hash = "57fa4a1abbf39f4899ea76543ebd3688dcc11e13"
		id = "7077daf6-3d51-5ff2-bc74-95cb169a7cd2"
	strings:
		$s0 = "volrec.sys" fullword wide
		$s1 = "volrec.pdb" fullword ascii
		$s2 = "Volume recognizer driver" fullword wide
	condition:
		all of them
}
YARA Detection Rule: apt_equation_keyword
Repository: Neo23x0/signature-base
Detects: Rule to detect Equation group's keyword in executable file
Reference: http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/

Pattern signatures:
$a1 = "Backsnarf_AB25" wide
         $a2 = "Backsnarf_AB25" ascii

Detection condition:
uint16(0) == 0x5a4d and 1 of ($a*)

Full rule:
rule apt_equation_keyword {
    meta:
        description = "Rule to detect Equation group's keyword in executable file"
        last_modified = "2015-09-26"
        reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
        id = "a7d4eda5-f390-5099-9c46-bf74a878b4f0"
    strings:
         $a1 = "Backsnarf_AB25" wide
         $a2 = "Backsnarf_AB25" ascii
    condition:
         uint16(0) == 0x5a4d and 1 of ($a*)
}
YARA Detection Rule: MAL_Fortinet_COATHANGER_Beacon
Repository: Neo23x0/signature-base
Detects: Detects COATHANGER beaconing code
Malware family: COATHANGER
Author: NLD MIVD - JSCU
Reference: https://www.ncsc.nl/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear

Pattern signatures:
$chunk_1 = { 48 B8 47 45 54 20 2F 20 48 54 48 89 45 B0 48 B8 54 50 2F 32 0A 48 6F 73 48 89 45 B8 48 B8 74 3A 20 77 77 77 2E 67 48 89 45 C0 48 B8 6F 6F 67 6C 65 2E 63 6F }

Detection condition:
uint32(0) == 0x464c457f and filesize < 5MB and
      any of them

Full rule:
rule MAL_Fortinet_COATHANGER_Beacon {
   meta:
      description = "Detects COATHANGER beaconing code"
      malware = "COATHANGER"
      author = "NLD MIVD - JSCU"
      date = "2024-02-06"
      reference = "https://www.ncsc.nl/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear"
      id = "0c84e6e4-afae-5150-82e2-8de528cd11fc"
   strings:
      $chunk_1 = { 48 B8 47 45 54 20 2F 20 48 54 48 89 45 B0 48 B8 54 50 2F 32 0A 48 6F 73 48 89 45 B8 48 B8 74 3A 20 77 77 77 2E 67 48 89 45 C0 48 B8 6F 6F 67 6C 65 2E 63 6F }
   condition:
      uint32(0) == 0x464c457f and filesize < 5MB and
      any of them
}
YARA Detection Rule: MAL_Fortinet_COATHANGER_Files
Repository: Neo23x0/signature-base
Detects: Detects COATHANGER files by used filenames
Malware family: COATHANGER
Author: NLD MIVD - JSCU
Reference: https://www.ncsc.nl/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear

Pattern signatures:
$1 = "/data2/"
      $2 = "/httpsd"
      $3 = "/preload.so"
      $4 = "/authd"
      $5 = "/tmp/packfile"
      $6 = "/smartctl"
      $7 = "/etc/ld.so.preload"
      $8 = "/newcli"
      $9 = "/bin/busybox"

Detection condition:
(uint32(0) == 0x464c457f or uint32(4) == 0x464c457f)
      and filesize < 5MB and 4 of them

Full rule:
rule MAL_Fortinet_COATHANGER_Files {
   meta:
      description = "Detects COATHANGER files by used filenames"
      malware = "COATHANGER"
      author = "NLD MIVD - JSCU"
      date = "2024-02-06"
      reference = "https://www.ncsc.nl/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear"
      id = "0aa2f266-247b-5510-9fd9-4c7940fb80e8"
   strings:
      $1 = "/data2/"
      $2 = "/httpsd"
      $3 = "/preload.so"
      $4 = "/authd"
      $5 = "/tmp/packfile"
      $6 = "/smartctl"
      $7 = "/etc/ld.so.preload"
      $8 = "/newcli"
      $9 = "/bin/busybox"
   condition:
      (uint32(0) == 0x464c457f or uint32(4) == 0x464c457f)
      and filesize < 5MB and 4 of them
}
YARA Detection Rule: Malware_JS_powershell_obfuscated
Repository: Neo23x0/signature-base
Detects: Unspecified malware - file rechnung_3.js
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "po\" + \"wer\" + \"sh\" + \"e\" + \"ll\";" fullword ascii

Detection condition:
filesize < 30KB and 1 of them

Full rule:
rule Malware_JS_powershell_obfuscated {
   meta:
      description = "Unspecified malware - file rechnung_3.js"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-03-24"
      hash1 = "3af15a2d60f946e0c4338c84bd39880652f676dc884057a96a10d7f802215760"
      id = "7995dd3a-5942-5c48-9e50-64f4964249a7"
   strings:
      $x1 = "po\" + \"wer\" + \"sh\" + \"e\" + \"ll\";" fullword ascii
   condition:
      filesize < 30KB and 1 of them
}
YARA Detection Rule: OSX_backdoor_EvilOSX
Repository: Neo23x0/signature-base
Detects: EvilOSX MacOS/OSX backdoor
Author: John Lambert @JohnLaTwC
Reference: https://github.com/Marten4n6/EvilOSX, https://twitter.com/JohnLaTwC/status/[PII_REDACTED]36498432

Pattern signatures:
$h1 = "#!/usr/bin/env"
        $s0 = "import base64" fullword ascii
        $s1 = "b64decode" fullword ascii

        //strings present in decoded python script:
        $x0 = "EvilOSX" fullword ascii
        $x1 = "get_launch_agent_directory" fullword ascii

        //Base64 encoded versions of these strings
        //EvilOSX
        $enc_x0 = /(AHYAaQBsAE8AUwBYA|dmlsT1NY|RQB2AGkAbABPAFMAWA|RXZpbE9TW|UAdgBpAGwATwBTAFgA|V2aWxPU1)/ ascii

        //get_launch_agent_directory
        $enc_x1 = /(AGUAdABfAGwAYQB1AG4AYwBoAF8AYQBnAGUAbgB0AF8AZABpAHIAZQBjAHQAbwByAHkA|cAZQB0AF8AbABhAHUAbgBjAGgAXwBhAGcAZQBuAHQAXwBkAGkAcgBlAGMAdABvAHIAeQ|dldF9sYXVuY2hfYWdlbnRfZGlyZWN0b3J5|Z2V0X2xhdW5jaF9hZ2VudF9kaXJlY3Rvcn|ZwBlAHQAXwBsAGEAdQBuAGMAaABfAGEAZwBlAG4AdABfAGQAaQByAGUAYwB0AG8AcgB5A|ZXRfbGF1bmNoX2FnZW50X2RpcmVjdG9ye)/ ascii

Detection condition:
uint32(0) == 0x752f2123
        and $h1 at 0
        and filesize < 30KB
        and all of ($s*)
        and
            1 of ($x*)
            or 1 of ($enc_x*)

Full rule:
rule OSX_backdoor_EvilOSX {
    meta:
        description = "EvilOSX MacOS/OSX backdoor"
        author = "John Lambert @JohnLaTwC"
        reference = "https://github.com/Marten4n6/EvilOSX, https://twitter.com/JohnLaTwC/status/[PII_REDACTED]36498432"
        date = "2018-02-23"
        hash = "89e5b8208daf85f549d9b7df8e2a062e47f15a5b08462a4224f73c0a6223972a"

        id = "6940e355-53d2-51e3-afd0-13303a311e9a"
    strings:
        $h1 = "#!/usr/bin/env"
        $s0 = "import base64" fullword ascii
        $s1 = "b64decode" fullword ascii

        //strings present in decoded python script:
        $x0 = "EvilOSX" fullword ascii
        $x1 = "get_launch_agent_directory" fullword ascii

        //Base64 encoded versions of these strings
        //EvilOSX
        $enc_x0 = /(AHYAaQBsAE8AUwBYA|dmlsT1NY|RQB2AGkAbABPAFMAWA|RXZpbE9TW|UAdgBpAGwATwBTAFgA|V2aWxPU1)/ ascii

        //get_launch_agent_directory
        $enc_x1 = /(AGUAdABfAGwAYQB1AG4AYwBoAF8AYQBnAGUAbgB0AF8AZABpAHIAZQBjAHQAbwByAHkA|cAZQB0AF8AbABhAHUAbgBjAGgAXwBhAGcAZQBuAHQAXwBkAGkAcgBlAGMAdABvAHIAeQ|dldF9sYXVuY2hfYWdlbnRfZGlyZWN0b3J5|Z2V0X2xhdW5jaF9hZ2VudF9kaXJlY3Rvcn|ZwBlAHQAXwBsAGEAdQBuAGMAaABfAGEAZwBlAG4AdABfAGQAaQByAGUAYwB0AG8AcgB5A|ZXRfbGF1bmNoX2FnZW50X2RpcmVjdG9ye)/ ascii

    condition:
        uint32(0) == 0x752f2123
        and $h1 at 0
        and filesize < 30KB
        and all of ($s*)
        and
            1 of ($x*)
            or 1 of ($enc_x*)
}
YARA Detection Rule: Agent_BTZ_Proxy_DLL_1
Repository: Neo23x0/signature-base
Detects: Detects Agent-BTZ Proxy DLL - activeds.dll
Author: Florian Roth (Nextron Systems)
Reference: http://www.intezer.com/new-variants-of-agent-btz-comrat-found/

Pattern signatures:
$s1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Modules" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and all of them and pe.exports("Entry") )

Full rule:
rule Agent_BTZ_Proxy_DLL_1 {
   meta:
      description = "Detects Agent-BTZ Proxy DLL - activeds.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
      date = "2017-08-07"
      hash1 = "9c163c3f2bd5c5181147c6f4cf[PII_REDACTED]de98f496d16b38c7dc46b5dc1426"
      hash2 = "628d316a983383ed716e3f[PII_REDACTED]83a8876b54677878a7d2db376d117a24"
      id = "f8032616-2a54-5107-b330-65fcc84b866e"
   strings:
      $s1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Modules" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them and pe.exports("Entry") )
}
YARA Detection Rule: Agent_BTZ_Proxy_DLL_2
Repository: Neo23x0/signature-base
Detects: Detects Agent-BTZ Proxy DLL - activeds.dll
Author: Florian Roth (Nextron Systems)
Reference: http://www.intezer.com/new-variants-of-agent-btz-comrat-found/

Pattern signatures:
$s1 = { 38 21 38 2C 38 37 38 42 38 4D 38 58 38 63 38 6E
               38 79 38 84 38 8F 38 9A 38 A5 38 B0 38 BB 38 C6
               38 D1 38 DC 38 E7 38 F2 38 FD 38 08 39 13 39 1E
               39 29 39 34 39 3F 39 4A 39 55 39 60 39 6B 39 76
               39 81 39 8C 39 97 39 A2 39 AD 39 B8 39 C3 39 CE
               39 D9 39 E4 39 EF 39 FA 39 05 3A 10 3A 1B 3A 26
               3A 31 3A 3C 3A 47 3A 52 3A 5D 3A 68 3A 73 3A 7E
               3A 89 3A 94 3A 9F 3A AA 3A B5 3A C0 3A CB 3A D6
               3A E1 3A EC 3A F7 3A }
      $s2 = "activeds.dll" ascii fullword

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and all of them and pe.imphash() == "09b7c73fbe5529e6de7137e3e8268b7b"

Full rule:
rule Agent_BTZ_Proxy_DLL_2 {
   meta:
      description = "Detects Agent-BTZ Proxy DLL - activeds.dll"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
      date = "2017-08-07"
      hash1 = "73db4295c5b29958c5d93c20be9482c1efffc89fc4e5c8ba59ac9425a4657a88"
      hash2 = "380b0353ba8cd33da8c5e5b95e3e032e83193019e73c71875b58ec1ed389bdac"
      hash3 = "f27e9bba6a[PII_REDACTED]b4334b807c0e4f57d3b790cecdc77d8fef50629f51a2"
      id = "2777443d-6f63-5948-855a-e064a6e0310f"
   strings:
      $s1 = { 38 21 38 2C 38 37 38 42 38 4D 38 58 38 63 38 6E
               38 79 38 84 38 8F 38 9A 38 A5 38 B0 38 BB 38 C6
               38 D1 38 DC 38 E7 38 F2 38 FD 38 08 39 13 39 1E
               39 29 39 34 39 3F 39 4A 39 55 39 60 39 6B 39 76
               39 81 39 8C 39 97 39 A2 39 AD 39 B8 39 C3 39 CE
               39 D9 39 E4 39 EF 39 FA 39 05 3A 10 3A 1B 3A 26
               3A 31 3A 3C 3A 47 3A 52 3A 5D 3A 68 3A 73 3A 7E
               3A 89 3A 94 3A 9F 3A AA 3A B5 3A C0 3A CB 3A D6
               3A E1 3A EC 3A F7 3A }
      $s2 = "activeds.dll" ascii fullword
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and all of them and pe.imphash() == "09b7c73fbe5529e6de7137e3e8268b7b"
}
YARA Detection Rule: Agent_BTZ_Aug17
Repository: Neo23x0/signature-base
Detects: Detects Agent.BTZ
Author: Florian Roth (Nextron Systems)
Reference: http://www.intezer.com/new-variants-of-agent-btz-comrat-found/

Pattern signatures:
$s1 = "stdole2.tlb" fullword ascii
      $s2 = "UnInstallW" fullword ascii

Detection condition:
(
         uint16(0) == 0x5a4d and filesize < 900KB and
         all of them and
         pe.exports("Entry") and pe.exports("InstallW") and pe.exports("UnInstallW")
      )

Full rule:
rule Agent_BTZ_Aug17 {
   meta:
      description = "Detects Agent.BTZ"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
      date = "2017-08-07"
      hash1 = "6ad78f069c3619d0d18eef[PII_REDACTED]f538cfe0c1b6d40b244beb359762cf96"
      hash2 = "49c5c798689d4a54e5b7099b647b0596fb96b996a437bb8241b5dd76e974c24e"
      hash3 = "e88970fa[PII_REDACTED]c[PII_REDACTED]fe63c875f149cd490c3c910a1c091d3ad49"
      id = "31804208-3edb-554b-8820-e682db647435"
   strings:
      $s1 = "stdole2.tlb" fullword ascii
      $s2 = "UnInstallW" fullword ascii
   condition:
      (
         uint16(0) == 0x5a4d and filesize < 900KB and
         all of them and
         pe.exports("Entry") and pe.exports("InstallW") and pe.exports("UnInstallW")
      )
}
YARA Detection Rule: APT_Turla_Agent_BTZ_Gen_1
Repository: Neo23x0/signature-base
Detects: Detects Turla Agent.BTZ
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "1dM3uu4j7Fw4sjnbcwlDqet4F7JyuUi4m5Imnxl1pzxI6as80cbLnmz54cs5Ldn4ri3do5L6gs923HL34x2f5cvd0fk6c1a0s" fullword ascii

      $s1 = "release mutex - %u (%u)(%u)" fullword ascii
      $s2 = "\\system32\\win.com" ascii
      $s3 = "Command Id:%u%010u(%02d:%02d:%02d %02d/%02d/%04d)" fullword ascii
      $s4 = "MakeFile Error(%d) copy file to temp file %s" fullword ascii
      $s5 = "%s%%s08x.tmp" fullword ascii
      $s6 = "Run instruction: %d ID:%u%010u(%02d:%02d:%02d %02d/%02d/%04d)" fullword ascii
      $s7 = "Mutex_Log" fullword ascii
      $s8 = "%s\\system32\\winview.ocx" fullword ascii
      $s9 = "Microsoft(R) Windows (R) Operating System" fullword wide
      $s10 = "Error: pos(%d) > CmdSize(%d)" fullword ascii
      $s11 = "\\win.com" ascii
      $s12 = "Error(%d) run %s " fullword ascii
      $s13 = "%02d.%02d.%04d Log begin:" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and (
         pe.imphash() == "9d0d6daa47d6e6f2d80eb05405944f87" or
         ( pe.exports("Entry") and pe.exports("InstallM") and pe.exports("InstallS") ) or
         $x1 or 3 of them
      ) or ( 5 of them )

Full rule:
rule APT_Turla_Agent_BTZ_Gen_1 {
   meta:
      description = "Detects Turla Agent.BTZ"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2018-06-16"
      score = 80
      hash1 = "c905f2dec79ccab115ad[PII_REDACTED]8696ebab02276f49f12465dcd026c1a615"
      id = "d5e1dd3d-4f03-5f79-898b-e612d2758b60"
   strings:
      $x1 = "1dM3uu4j7Fw4sjnbcwlDqet4F7JyuUi4m5Imnxl1pzxI6as80cbLnmz54cs5Ldn4ri3do5L6gs923HL34x2f5cvd0fk6c1a0s" fullword ascii

      $s1 = "release mutex - %u (%u)(%u)" fullword ascii
      $s2 = "\\system32\\win.com" ascii
      $s3 = "Command Id:%u%010u(%02d:%02d:%02d %02d/%02d/%04d)" fullword ascii
      $s4 = "MakeFile Error(%d) copy file to temp file %s" fullword ascii
      $s5 = "%s%%s08x.tmp" fullword ascii
      $s6 = "Run instruction: %d ID:%u%010u(%02d:%02d:%02d %02d/%02d/%04d)" fullword ascii
      $s7 = "Mutex_Log" fullword ascii
      $s8 = "%s\\system32\\winview.ocx" fullword ascii
      $s9 = "Microsoft(R) Windows (R) Operating System" fullword wide
      $s10 = "Error: pos(%d) > CmdSize(%d)" fullword ascii
      $s11 = "\\win.com" ascii
      $s12 = "Error(%d) run %s " fullword ascii
      $s13 = "%02d.%02d.%04d Log begin:" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 500KB and (
         pe.imphash() == "9d0d6daa47d6e6f2d80eb05405944f87" or
         ( pe.exports("Entry") and pe.exports("InstallM") and pe.exports("InstallS") ) or
         $x1 or 3 of them
      ) or ( 5 of them )
}
YARA Detection Rule: SUSP_LNK_lnkfileoverRFC
Repository: Neo23x0/signature-base
Detects: Detects APT lnk files that run double extraction and launch routines with autoruns
Author: @Grotezinfosec, modified by Florian Roth

Pattern signatures:
$command = "C:\\Windows\\System32\\cmd.exe" fullword ascii //cmd is precursor to findstr
      $command2 =  {2F 00 63 00 20 00 66 00 69 00 6E 00 64 00 73 00 74 00 72} //findstr in hex
      $base64 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD" ascii //some base64 filler, needed to work with routine
      $cert = " -decode " ascii //base64 decoder

Detection condition:
uint16(0) == 0x004c and uint32(4) == 0x00021401 and
      filesize > 15KB and (
         2 of them
      )

Full rule:
rule SUSP_LNK_lnkfileoverRFC {
   meta:
      description = "Detects APT lnk files that run double extraction and launch routines with autoruns"
      author = "@Grotezinfosec, modified by Florian Roth"
      date = "2018-09-18"
      id = "19c393af-ff7c-5345-a3ef-c06372344baf"
   strings:
      $command = "C:\\Windows\\System32\\cmd.exe" fullword ascii //cmd is precursor to findstr
      $command2 =  {2F 00 63 00 20 00 66 00 69 00 6E 00 64 00 73 00 74 00 72} //findstr in hex
      $base64 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD" ascii //some base64 filler, needed to work with routine
      $cert = " -decode " ascii //base64 decoder
   condition:
      uint16(0) == 0x004c and uint32(4) == 0x00021401 and
      filesize > 15KB and (
         2 of them
      )
}
YARA Detection Rule: SUSP_LNK_SuspiciousCommands
Repository: Neo23x0/signature-base
Detects: Detects LNK file with suspicious content
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = " -decode " ascii wide
      $s2 = " -enc " ascii wide
      $s3 = " -w hidden " ascii wide
      $s4 = " -ep bypass " ascii wide
      $s5 = " -noni " ascii nocase wide
      /* $s6 = " bypass " ascii wide */
      $s7 = " -noprofile " ascii wide
      $s8 = ".DownloadString(" ascii wide
      $s9 = ".DownloadFile(" ascii wide
      $s10 = "IEX(" ascii wide
      $s11 = "iex(" ascii wide
      $s12 = "WScript.shell" ascii wide fullword nocase
      $s13 = " -nop " ascii wide
      $s14 = "&tasklist>"
      $s15 = "setlocal EnableExtensions DisableDelayedExpansion"
      $s16 = "echo^ set^"
      $s17 = "del /f /q "
      $s18 = " echo | start "
      $s19 = "&& echo "
      $s20 = "&&set "
      $s21 = "%&&@echo off "

Detection condition:
uint16(0) == 0x004c and 1 of them

Full rule:
rule SUSP_LNK_SuspiciousCommands {
   meta:
      description = "Detects LNK file with suspicious content"
      author = "Florian Roth (Nextron Systems)"
      date = "2018-09-18"
      score = 60
      id = "8bfb1322-8e33-50bc-a389-2d8bdfec9ca7"
   strings:
      $s1 = " -decode " ascii wide
      $s2 = " -enc " ascii wide
      $s3 = " -w hidden " ascii wide
      $s4 = " -ep bypass " ascii wide
      $s5 = " -noni " ascii nocase wide
      /* $s6 = " bypass " ascii wide */
      $s7 = " -noprofile " ascii wide
      $s8 = ".DownloadString(" ascii wide
      $s9 = ".DownloadFile(" ascii wide
      $s10 = "IEX(" ascii wide
      $s11 = "iex(" ascii wide
      $s12 = "WScript.shell" ascii wide fullword nocase
      $s13 = " -nop " ascii wide
      $s14 = "&tasklist>"
      $s15 = "setlocal EnableExtensions DisableDelayedExpansion"
      $s16 = "echo^ set^"
      $s17 = "del /f /q "
      $s18 = " echo | start "
      $s19 = "&& echo "
      $s20 = "&&set "
      $s21 = "%&&@echo off "
   condition:
      uint16(0) == 0x004c and 1 of them
}
YARA Detection Rule: SUSP_DOC_LNK_in_ZIP
Repository: Neo23x0/signature-base
Detects: Detects suspicious .doc.lnk file in ZIP archive
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/RedDrip7/status/[PII_REDACTED]45025029

Pattern signatures:
$s1 = ".doc.lnk" fullword ascii

Detection condition:
uint16(0) == 0x4b50 and 1 of them

Full rule:
rule SUSP_DOC_LNK_in_ZIP {
   meta:
      description = "Detects suspicious .doc.lnk file in ZIP archive"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/RedDrip7/status/[PII_REDACTED]45025029"
      date = "2019-07-02"
      score = 50
      hash1 = "7ea4f77cac557044e72a8e280372a2abe072f2ad98b5a4fbed4e2229e780173a"
      id = "9c140d02-3b18-5faf-bb1d-2eb5c07a23dc"
   strings:
      $s1 = ".doc.lnk" fullword ascii
   condition:
      uint16(0) == 0x4b50 and 1 of them
}
YARA Detection Rule: PoS_Malware_MalumPOS
Repository: Neo23x0/signature-base
Detects: Used to detect MalumPOS memory dumper
Author: Trend Micro, Inc.

Pattern signatures:
$string1 = "SOFTWARE\\Borland\\Delphi\\RTL"
        $string2 = "B)[0-9]{13,19}\\"
        $string3 = "[A-Za-z\\s]{0,30}\\/[A-Za-z\\s]{0,30}\\"
        $string4 = "TRegExpr(exec): ExecNext Without Exec[Pos]"
        $string5 = /Y:\\PROGRAMS\\.{20,300}\.pas/

Detection condition:
all of ($string*)

Full rule:
rule PoS_Malware_MalumPOS
{
    meta:
        author = "Trend Micro, Inc."
        date = "2015-05-25"
        description = "Used to detect MalumPOS memory dumper"
        sample_filtype = "exe"
        id = "6d85c7fe-bf1b-53fb-b618-4b0f8b63cae4"
    strings:
        $string1 = "SOFTWARE\\Borland\\Delphi\\RTL"
        $string2 = "B)[0-9]{13,19}\\"
        $string3 = "[A-Za-z\\s]{0,30}\\/[A-Za-z\\s]{0,30}\\"
        $string4 = "TRegExpr(exec): ExecNext Without Exec[Pos]"
        $string5 = /Y:\\PROGRAMS\\.{20,300}\.pas/
    condition:
        all of ($string*)
}