deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Rehashed_RAT_1
Repository: Neo23x0/signature-base
Detects: Detects malware from Rehashed RAT incident
Author: Florian Roth (Nextron Systems)
Reference: https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations

Pattern signatures:
$x1 = "C:\\Users\\hoogle168\\Desktop\\"
      $x2 = "\\NewCoreCtrl08\\Release\\NewCoreCtrl08.pdb" ascii

      $s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729" ascii
      $s2 = "NewCoreCtrl08.dll" fullword ascii
      $s3 = "GET /%s%s%s%s HTTP/1.1" fullword ascii
      $s4 = "http://%s:%d/%s%s%s%s" fullword ascii
      $s5 = "MyTmpFile.Dat" fullword wide
      $s6 = "root\\%s" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 800KB and (
            pe.imphash() == "893212784d01f11aed9ebb42ad2561fc" or
            pe.exports("ProcessTrans") or
            ( 1 of ($x*) or 4 of them )
         )
      ) or ( all of them )

Full rule:
rule Rehashed_RAT_1 {
   meta:
      description = "Detects malware from Rehashed RAT incident"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations"
      date = "2017-09-08"
      hash1 = "37bd97779e854ea2fc43486ddb831a5acfd19cf89f06823c9fd3b20134cb1c35"
      id = "24536421-3f8f-58f3-8245-06c519d7a21a"
   strings:
      $x1 = "C:\\Users\\hoogle168\\Desktop\\"
      $x2 = "\\NewCoreCtrl08\\Release\\NewCoreCtrl08.pdb" ascii

      $s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729" ascii
      $s2 = "NewCoreCtrl08.dll" fullword ascii
      $s3 = "GET /%s%s%s%s HTTP/1.1" fullword ascii
      $s4 = "http://%s:%d/%s%s%s%s" fullword ascii
      $s5 = "MyTmpFile.Dat" fullword wide
      $s6 = "root\\%s" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 800KB and (
            pe.imphash() == "893212784d01f11aed9ebb42ad2561fc" or
            pe.exports("ProcessTrans") or
            ( 1 of ($x*) or 4 of them )
         )
      ) or ( all of them )
}
YARA Detection Rule: Rehashed_RAT_2
Repository: Neo23x0/signature-base
Detects: Detects malware from Rehashed RAT incident
Author: Florian Roth (Nextron Systems)
Reference: https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations

Pattern signatures:
$x1 = "dalat.dulichovietnam.net" fullword ascii
      $x2 = "web.Thoitietvietnam.org" fullword ascii

      $a1 = "User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64)" fullword ascii
      $a2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3" ascii

      $s1 = "GET /%s%s%s%s HTTP/1.1" fullword ascii
      $s2 = "http://%s:%d/%s%s%s%s" fullword ascii
      $s3 = "{521338B8-3378-58F7-AFB9-E7D35E683BF8}" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and
        filesize < 300KB and (
           pe.imphash() == "9c4c648f4a758cbbfe28c8850d82f931" or
           ( 1 of ($x*) or 3 of them )
        )
      ) or ( 4 of them )

Full rule:
rule Rehashed_RAT_2 {
   meta:
      description = "Detects malware from Rehashed RAT incident"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations"
      date = "2017-09-08"
      hash1 = "49efab1dedc6fffe5a8f980688a5ebefce1be3d0d180d5dd035f02ce396c9966"
      id = "fcf82155-10da-56b7-879b-841c4ae5023b"
   strings:
      $x1 = "dalat.dulichovietnam.net" fullword ascii
      $x2 = "web.Thoitietvietnam.org" fullword ascii

      $a1 = "User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64)" fullword ascii
      $a2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3" ascii

      $s1 = "GET /%s%s%s%s HTTP/1.1" fullword ascii
      $s2 = "http://%s:%d/%s%s%s%s" fullword ascii
      $s3 = "{521338B8-3378-58F7-AFB9-E7D35E683BF8}" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and
        filesize < 300KB and (
           pe.imphash() == "9c4c648f4a758cbbfe28c8850d82f931" or
           ( 1 of ($x*) or 3 of them )
        )
      ) or ( 4 of them )
}
YARA Detection Rule: Rehashed_RAT_3
Repository: Neo23x0/signature-base
Detects: Detects malware from Rehashed RAT incident
Author: Florian Roth (Nextron Systems)
Reference: https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations

Pattern signatures:
$x1 = "\\BisonNewHNStubDll\\Release\\Goopdate.pdb" ascii
      $s2 = "psisrndrx.ebd" fullword wide
      $s3 = "pbad exception" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of ($x*) or 2 of them )

Full rule:
rule Rehashed_RAT_3 {
   meta:
      description = "Detects malware from Rehashed RAT incident"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations"
      date = "2017-09-08"
      modified = "2022-12-21"
      hash1 = "9cebae97a067cd7c2be50d7fd8afe5e9cf935c11914a1ab5ff59e91c1e7e5fc4"
      id = "59871be1-295f-54ee-ab4d-4f9e5fdc2935"
   strings:
      $x1 = "\\BisonNewHNStubDll\\Release\\Goopdate.pdb" ascii
      $s2 = "psisrndrx.ebd" fullword wide
      $s3 = "pbad exception" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of ($x*) or 2 of them )
}
YARA Detection Rule: Invoke_OSiRis
Repository: Neo23x0/signature-base
Detects: Osiris Device Guard Bypass - file Invoke-OSiRis.ps1
Author: Florian Roth
Reference: Internal Research

Pattern signatures:
$x1 = "$null = Iwmi Win32_Process -EnableA -Impers 3 -AuthenPacketprivacy -Name Create -Arg $ObfusK -Computer $Target" ascii wide
      $x3 = "-Arg@{Name=$VarName;VariableValue=$OSiRis;UserName=$env:Username}" ascii wide
      $x4 = "Device Guard Bypass Command Execution" ascii wide

Detection condition:
filesize < 8MB
      and 1 of them

Full rule:
rule Invoke_OSiRis {
   meta:
      description = "Osiris Device Guard Bypass - file Invoke-OSiRis.ps1"
      author = "Florian Roth"
      reference = "Internal Research"
      date = "2017-03-27"
      modified = "2025-03-21"
      score = 70
      hash1 = "19e4a8b07f85c3d4c396d0c4e839495c9fba9405c06a631d57af588032d2416e"
   strings:
      $x1 = "$null = Iwmi Win32_Process -EnableA -Impers 3 -AuthenPacketprivacy -Name Create -Arg $ObfusK -Computer $Target" ascii wide
      $x3 = "-Arg@{Name=$VarName;VariableValue=$OSiRis;UserName=$env:Username}" ascii wide
      $x4 = "Device Guard Bypass Command Execution" ascii wide
   condition:
      filesize < 8MB
      and 1 of them
}
YARA Detection Rule: MAL_WshRAT_Dotnet_Packer_Feb21
Repository: Neo23x0/signature-base
Detects: Yara Rule for WSH rat .NET packer of February 2021 
Author: Yoroi Malware ZLab
Reference: https://yoroi.company/research/threatening-within-budget-how-wsh-rat-is-abused-by-cyber-crooks/

Pattern signatures:
$a1 = { BE DD 60 8C 34 49 9A 54 D2 40 }
        $a2 = { 1D D7 24 22 47 A6 B1 A5 }
        $a3 = { 13 30 03 00 07 00 00 00 01 } 
        $a4 = { 11 02 03 7D 78 00 00 04 2A }
        $a5 = { A8 8A F4 C8 61 2B CA 07 }
        $a6 = { 15 AE 5E AB 5A 20 FE B5 56 B4 61 2B BB 06 2A}

Detection condition:
uint16(0) == 0x5A4D and 3 of them

Full rule:
rule MAL_WshRAT_Dotnet_Packer_Feb21 {
    meta:
        description = "Yara Rule for WSH rat .NET packer of February 2021 "
        author = "Yoroi Malware ZLab"
        date = "2021-03-09"
        reference = "https://yoroi.company/research/threatening-within-budget-how-wsh-rat-is-abused-by-cyber-crooks/"
        id = "62e043fc-7d13-5b91-9fdd-e71d91194da2"
    strings:
        $a1 = { BE DD 60 8C 34 49 9A 54 D2 40 }
        $a2 = { 1D D7 24 22 47 A6 B1 A5 }
        $a3 = { 13 30 03 00 07 00 00 00 01 } 
        $a4 = { 11 02 03 7D 78 00 00 04 2A }
        $a5 = { A8 8A F4 C8 61 2B CA 07 }
        $a6 = { 15 AE 5E AB 5A 20 FE B5 56 B4 61 2B BB 06 2A}
    condition:
        uint16(0) == 0x5A4D and 3 of them
}
YARA Detection Rule: ATM_Malware_DispenserXFS
Repository: Neo23x0/signature-base
Detects: Detects ATM Malware DispenserXFS
Author: @Xylit0l @r3c0nst / Modified by Florian Roth
Reference: https://twitter.com/r3c0nst/status/[PII_REDACTED]06652673

Pattern signatures:
$xc1 = { 68 FF FF 00 00 68 60 EA 00 00 6A 10 }
      $s1 = "\\dispenserXFS.pdb" ascii
      $s3 = "C:\\xfsasdf.txt" fullword ascii
      $s4 = "Injected mxsfs killer into %d." fullword ascii
      $s5 = "Waiting for freeze msxfs processes..." fullword ascii

Detection condition:
uint16(0) == 0x5A4D and (
         1 of them or
         pe.imphash() == "617e037ae26d1931818db0790fb44bfe"
      )

Full rule:
rule ATM_Malware_DispenserXFS {
   meta:
      description = "Detects ATM Malware DispenserXFS"
      author = "@Xylit0l @r3c0nst / Modified by Florian Roth"
      reference = "https://twitter.com/r3c0nst/status/[PII_REDACTED]06652673"
      date = "2019/02/27"
      modified = "2023-01-06"
      score = 80
      id = "7c06102c-93d3-52f4-8c25-430f6f7a601f"
   strings:
      $xc1 = { 68 FF FF 00 00 68 60 EA 00 00 6A 10 }
      $s1 = "\\dispenserXFS.pdb" ascii
      $s3 = "C:\\xfsasdf.txt" fullword ascii
      $s4 = "Injected mxsfs killer into %d." fullword ascii
      $s5 = "Waiting for freeze msxfs processes..." fullword ascii
   condition:
      uint16(0) == 0x5A4D and (
         1 of them or
         pe.imphash() == "617e037ae26d1931818db0790fb44bfe"
      )
}
YARA Detection Rule: TurlaMosquito_Mal_1
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Turla Mosquito report
Author: Florian Roth (Nextron Systems)
Reference: https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf

Pattern signatures:
$s1 = "Pipetp" fullword ascii
      $s2 = "EStOpnabn" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 2000KB and (
        pe.imphash() == "169d4237c79549303cca870592278f42" or
        all of them
      )

Full rule:
rule TurlaMosquito_Mal_1 {
   meta:
      description = "Detects malware sample from Turla Mosquito report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
      date = "2018-02-22"
      hash1 = "b[PII_REDACTED]43f5b6b3c87ad22bcf8b55ecc9244aa9f6f88fc28f36f5aa2925e"
      id = "1395509a-72f5-56c0-895c-3e9f15829de1"
   strings:
      $s1 = "Pipetp" fullword ascii
      $s2 = "EStOpnabn" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 2000KB and (
        pe.imphash() == "169d4237c79549303cca870592278f42" or
        all of them
      )
}
YARA Detection Rule: TurlaMosquito_Mal_2
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Turla Mosquito report
Author: Florian Roth (Nextron Systems)
Reference: https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf

Pattern signatures:
$s1 = ".?AVFileNameParseException@ExecuteFile@@" fullword ascii
      $s3 = "no_address" fullword wide
      $s6 = "SRRRQP" fullword ascii
      $s7 = "QWVPQQ" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 600KB and (
        pe.imphash() == "cd918073f209c5da7a16b6c125d73746" or
        all of them
      )

Full rule:
rule TurlaMosquito_Mal_2 {
   meta:
      description = "Detects malware sample from Turla Mosquito report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
      date = "2018-02-22"
      hash1 = "68c6e9dea81f082601ae5afc41870cea3f71b22bfc19bcfbc61d84786e481cb4"
      hash2 = "05254971fe3e1ca448844f8cfcfb2b0de27e48abd45ea2a3df897074a419a3f4"
      id = "d23d9fe1-26e3-5012-8a88-61ebbc3fbd8f"
   strings:
      $s1 = ".?AVFileNameParseException@ExecuteFile@@" fullword ascii
      $s3 = "no_address" fullword wide
      $s6 = "SRRRQP" fullword ascii
      $s7 = "QWVPQQ" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 600KB and (
        pe.imphash() == "cd918073f209c5da7a16b6c125d73746" or
        all of them
      )
}
YARA Detection Rule: TurlaMosquito_Mal_3
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Turla Mosquito report
Author: Florian Roth (Nextron Systems)
Reference: https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf

Pattern signatures:
$x1 = "InstructionerDLL.dll" fullword ascii

      $s1 = "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" fullword wide
      $s2 = "/scripts/m/query.php?id=" fullword wide
      $s3 = "SELECT * FROM AntiVirusProduct" fullword ascii
      $s4 = "Microsoft Update" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 400KB and (
         pe.imphash() == "88488fe0b8bcd6e379dea6433bb5d7d8" or
         ( pe.exports("InstallRoutineW") and pe.exports("StartRoutine") ) or
         $x1 or
         3 of them
      )

Full rule:
rule TurlaMosquito_Mal_3 {
   meta:
      description = "Detects malware sample from Turla Mosquito report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
      date = "2018-02-22"
      hash1 = "443cd03b37fca8a5df1bbaa6320649b441ca50d1c1fcc4f5a7b94b95040c73d1"
      id = "c83e0a93-3f8d-572d-ac1a-92fef0b3d3f6"
   strings:
      $x1 = "InstructionerDLL.dll" fullword ascii

      $s1 = "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" fullword wide
      $s2 = "/scripts/m/query.php?id=" fullword wide
      $s3 = "SELECT * FROM AntiVirusProduct" fullword ascii
      $s4 = "Microsoft Update" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 400KB and (
         pe.imphash() == "88488fe0b8bcd6e379dea6433bb5d7d8" or
         ( pe.exports("InstallRoutineW") and pe.exports("StartRoutine") ) or
         $x1 or
         3 of them
      )
}
YARA Detection Rule: TurlaMosquito_Mal_4
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Turla Mosquito report
Author: Florian Roth (Nextron Systems)
Reference: https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf

Detection condition:
uint16(0) == 0x5a4d and filesize < 800KB and pe.imphash() == "17b328245e2874a76c2f46f9a92c3bad"

Full rule:
rule TurlaMosquito_Mal_4 {
   meta:
      description = "Detects malware sample from Turla Mosquito report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
      date = "2018-02-22"
      hash1 = "b362b235539b762734a1833c7e6c366c1b46474f05dc17b3a631b3bff95a5eec"
      id = "1d5c32b3-0316-525c-[PII_REDACTED]"
   condition:
      uint16(0) == 0x5a4d and filesize < 800KB and pe.imphash() == "17b328245e2874a76c2f46f9a92c3bad"
}
YARA Detection Rule: TurlaMosquito_Mal_5
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Turla Mosquito report
Author: Florian Roth (Nextron Systems)
Reference: https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and pe.imphash() == "ac40cf7479f53a4754ac6481a4f24e57"

Full rule:
rule TurlaMosquito_Mal_5 {
   meta:
      description = "Detects malware sample from Turla Mosquito report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
      date = "2018-02-22"
      hash1 = "26a1a42bc74e14887616f9d6048c17b1b[PII_REDACTED]a6426e7162426e1a08030"
      id = "9f3a35c9-b0f0-5ca6-8b34-19e2d45305f2"
   condition:
      uint16(0) == 0x5a4d and filesize < 300KB and pe.imphash() == "ac40cf7479f53a4754ac6481a4f24e57"
}
YARA Detection Rule: TurlaMosquito_Mal_6
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Turla Mosquito report
Author: Florian Roth (Nextron Systems)
Reference: https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf

Pattern signatures:
$a1 = "/scripts/m/query.php?id=" fullword wide
      $a2 = "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" fullword wide
      $a3 = "GetUserNameW fails" fullword wide

      $s1 = "QVSWQQ" fullword ascii
      $s2 = "SRRRQP" fullword ascii
      $s3 = "QSVVQQ" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and (
         2 of ($a*) or
         4 of them
      )

Full rule:
rule TurlaMosquito_Mal_6 {
   meta:
      description = "Detects malware sample from Turla Mosquito report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
      date = "2018-02-22"
      hash1 = "b79cdf929d4a340bdd5f29b3aeccd3c65e39540d4529b64e50ebeacd9cdee5e9"
      id = "1c320b60-ec7a-5f87-b871-f55924351f8f"
   strings:
      $a1 = "/scripts/m/query.php?id=" fullword wide
      $a2 = "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" fullword wide
      $a3 = "GetUserNameW fails" fullword wide

      $s1 = "QVSWQQ" fullword ascii
      $s2 = "SRRRQP" fullword ascii
      $s3 = "QSVVQQ" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 500KB and (
         2 of ($a*) or
         4 of them
      )
}
YARA Detection Rule: APT_TurlaMosquito_MAL_Oct22_1
Repository: Neo23x0/signature-base
Detects: Detects Turla Mosquito malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf

Pattern signatures:
$s1 = "Logger32.dll" ascii fullword
      $s4 = " executing %u command on drive %martCommand : CWin32ApiErrorExce" wide
      $s5 = "Unsupported drive!!!" ascii fullword
      $s7 = "D:\\Build_SVN\\PC_MAGICIAN_4." ascii fullword

      $op1 = { 40 cc 8b 8b 06 cc 55 00 70 8b 10 10 33 51 04 46 04 64 }
      $op2 = { c3 10 e8 50 04 00 cc ff 8d 00 69 8d 75 ff 68 ec 6a 4d }
      $op3 = { e8 64 a1 6e 00 64 a1 c2 04 08 75 40 73 1d 8b ff cc 10 89 cc 8b c3 cc af }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 2000KB and
      (
         pe.imphash() == "073235ae6dfbb1bf5db68a039a7b7726" or
         all of them
      )

Full rule:
rule APT_TurlaMosquito_MAL_Oct22_1 {
   meta:
      description = "Detects Turla Mosquito malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
      date = "2022-10-25"
      score = 80
      hash1 = "6b9e48e3f4873cfb95639d9944fe60e3b056daaa2ea914add14c982e3e11128b"
      hash2 = "b868b674476418bbdffbe0f3d617d1cce4c2b9dae0eaf3414e538376523e8405"
      hash3 = "e7fd14ca[PII_REDACTED]0ca67f201cc8cfb916ccc941a105927fc4c932c72b425d"
      id = "f5ad0c0f-81ca-5157-aefb-ead049ada30d"
   strings:
      $s1 = "Logger32.dll" ascii fullword
      $s4 = " executing %u command on drive %martCommand : CWin32ApiErrorExce" wide
      $s5 = "Unsupported drive!!!" ascii fullword
      $s7 = "D:\\Build_SVN\\PC_MAGICIAN_4." ascii fullword

      $op1 = { 40 cc 8b 8b 06 cc 55 00 70 8b 10 10 33 51 04 46 04 64 }
      $op2 = { c3 10 e8 50 04 00 cc ff 8d 00 69 8d 75 ff 68 ec 6a 4d }
      $op3 = { e8 64 a1 6e 00 64 a1 c2 04 08 75 40 73 1d 8b ff cc 10 89 cc 8b c3 cc af }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 2000KB and
      (
         pe.imphash() == "073235ae6dfbb1bf5db68a039a7b7726" or
         all of them
      )
}
YARA Detection Rule: EXPL_GitLab_CE_RCE_CVE_2021_22205
Repository: Neo23x0/signature-base
Detects: Detects signs of exploitation of GitLab CE CVE-2021-22205
Author: Florian Roth (Nextron Systems)
Reference: https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/

Pattern signatures:
/* User.find_by(username */
      $sa1 = "VXNlci5maW5kX2J5KHVzZXJuYW1l" ascii
      $sa2 = "VzZXIuZmluZF9ieSh1c2VybmFtZ" ascii
      $sa3 = "Vc2VyLmZpbmRfYnkodXNlcm5hbW" ascii

      /* user.admin */
      $sb1 = "dXNlci5hZG1pb" ascii
      $sb2 = "VzZXIuYWRtaW" ascii
      $sb3 = "1c2VyLmFkbWlu" ascii

      /* user.save! */
      $sc1 = "dXNlci5zYXZlI" ascii
      $sc2 = "VzZXIuc2F2ZS" ascii
      $sc3 = "1c2VyLnNhdmUh" ascii

Detection condition:
1 of ($sa*) and 1 of ($sb*) and 1 of ($sc*)

Full rule:
rule EXPL_GitLab_CE_RCE_CVE_2021_22205 {
   meta:
      description = "Detects signs of exploitation of GitLab CE CVE-2021-22205"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/"
      date = "2021-10-26"
      score = 70
      id = "21cc6fa7-e50d-5b8e-815d-27315ab5635d"
   strings:
      /* User.find_by(username */
      $sa1 = "VXNlci5maW5kX2J5KHVzZXJuYW1l" ascii
      $sa2 = "VzZXIuZmluZF9ieSh1c2VybmFtZ" ascii
      $sa3 = "Vc2VyLmZpbmRfYnkodXNlcm5hbW" ascii

      /* user.admin */
      $sb1 = "dXNlci5hZG1pb" ascii
      $sb2 = "VzZXIuYWRtaW" ascii
      $sb3 = "1c2VyLmFkbWlu" ascii

      /* user.save! */
      $sc1 = "dXNlci5zYXZlI" ascii
      $sc2 = "VzZXIuc2F2ZS" ascii
      $sc3 = "1c2VyLnNhdmUh" ascii
   condition:
      1 of ($sa*) and 1 of ($sb*) and 1 of ($sc*)
}
YARA Detection Rule: EXPL_GitLab_CE_RCE_Malformed_JPG_CVE_2021_22204
Repository: Neo23x0/signature-base
Detects: Detects malformed JPG files exploting EXIF vulnerability CVE-2021-22204 and used in the exploitation of GitLab vulnerability CVE-2021-22205
Author: Florian Roth (Nextron Systems)
Reference: https://attackerkb.com/topics/D41jRUXCiJ/cve-2021-22205/rapid7-analysis?referrer=blog

Pattern signatures:
$h1 = { 41 54 26 54 46 4F 52 4D }
      $sr1 = /\(metadata[\s]{0,3}\([A-Za-z]{1,20} "\\/

Detection condition:
filesize < 10KB 
      and $h1
      and $sr1

Full rule:
rule EXPL_GitLab_CE_RCE_Malformed_JPG_CVE_2021_22204 {
   meta:
      description = "Detects malformed JPG files exploting EXIF vulnerability CVE-2021-22204 and used in the exploitation of GitLab vulnerability CVE-2021-22205"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://attackerkb.com/topics/D41jRUXCiJ/cve-2021-22205/rapid7-analysis?referrer=blog"
      date = "2021-10-26"
      score = 70
      id = "3d[PII_REDACTED]-596d-8783-2b37b93a5673"
   strings:
      $h1 = { 41 54 26 54 46 4F 52 4D }
      $sr1 = /\(metadata[\s]{0,3}\([A-Za-z]{1,20} "\\/
   condition:
      filesize < 10KB 
      and $h1
      and $sr1
}