deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EquationGroup_Toolset_Apr17__LSADUMP_Lp_ModifyPrivilege_Lp_PacketScan_Lp_put_Lp_RemoteExecute_Lp_Windows_Lp_wmi_Lp_9
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "Injection Lib -  " wide
      $x2 = "LSADUMP - - ERROR" wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17__LSADUMP_Lp_ModifyPrivilege_Lp_PacketScan_Lp_put_Lp_RemoteExecute_Lp_Windows_Lp_wmi_Lp_9 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      super_rule = 1
      hash1 = "c7bf4c012293e7de56d86f4f5b4eeb6c1c5263568cc4d9863a286a86b5daf194"
      hash2 = "d92928a867a685274b0a74ec55c0b83690fca[PII_REDACTED]79e184e2787d47f48"
      hash3 = "2d963529e6db733c5b74db1894d75493507e6e40da0de2f33e301959b50f3d32"
      hash4 = "e9f6a84899c9a042edbbff391ca076169da1a6f6dfb61b927942fe4be3327749"
      hash5 = "d989d610b032c72252a2df284d0b53f63f382e305de2a18b453a0510ab6246a3"
      hash6 = "23d98bca1f6e2f6989d53c2f2adff996ede2c961ea189744f8ae65621003b8b1"
      hash7 = "d7ae24816fda190feda6a60639cf3716ea00fb63a4bd1069b8ce52d10ad8bc7f"
      id = "0bf57f93-0a03-5241-94b8-1cd69f22b055"
   strings:
      $x1 = "Injection Lib -  " wide
      $x2 = "LSADUMP - - ERROR" wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17__ETBL_ETRE_10
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "Probe #2 usage: %s -i TargetIp -p TargetPort -r %d [-o TimeOut] -t Protocol -n IMailUserName -a IMailPassword" fullword ascii
      $x6 = "** RunExploit ** - EXCEPTION_EXECUTE_HANDLER : 0x%08X" fullword ascii
      $s19 = "Sending Implant Payload.. cEncImplantPayload size(%d)" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17__ETBL_ETRE_10 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      super_rule = 1
      hash1 = "70db3ac2c1a10de6ce6b3e7a7890c37bffde006ea6d441f5de6d8329add4d2ef"
      hash2 = "e0f05f26293e3231e4e32916ad8a6ee944af842410c194fce8a0d8ad2f5c54b2"
      id = "7dfff868-cb66-51c0-a7c7-5cc872232b86"
   strings:
      $x1 = "Probe #2 usage: %s -i TargetIp -p TargetPort -r %d [-o TimeOut] -t Protocol -n IMailUserName -a IMailPassword" fullword ascii
      $x6 = "** RunExploit ** - EXCEPTION_EXECUTE_HANDLER : 0x%08X" fullword ascii
      $s19 = "Sending Implant Payload.. cEncImplantPayload size(%d)" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17__ELV_ESKE_ETBL_ETRE_EVFR_11
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "Target is vulnerable" fullword ascii
      $x2 = "Target is NOT vulnerable" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17__ELV_ESKE_ETBL_ETRE_EVFR_11 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      super_rule = 1
      hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
      hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
      hash3 = "70db3ac2c1a10de6ce6b3e7a7890c37bffde006ea6d441f5de6d8329add4d2ef"
      hash4 = "e0f05f26293e3231e4e32916ad8a6ee944af842410c194fce8a0d8ad2f5c54b2"
      hash5 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
      id = "d6848065-377b-5eda-821d-d2cc16f483cc"
   strings:
      $x1 = "Target is vulnerable" fullword ascii
      $x2 = "Target is NOT vulnerable" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_RideArea2_12
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x2 = "** CreatePayload ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_RideArea2_12 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      super_rule = 1
      hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
      hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
      hash3 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
      hash4 = "e702223ab42c54fff96f198611d0b2e8a1ceba40586d466ba9aadfa2fd34386e"
      id = "63c7733c-9942-56f3-95cc-f3e72b693739"
   strings:
      $x2 = "** CreatePayload ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17__ELV_ESKE_13
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "Skip call to PackageRideArea().  Payload has already been packaged. Options -x and -q ignored." fullword ascii
      $s2 = "ERROR: pGvars->pIntRideAreaImplantPayload is NULL" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 600KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17__ELV_ESKE_13 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      super_rule = 1
      hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
      hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
      id = "8bc3c47c-7357-5692-86aa-e43b40f8c1ab"
   strings:
      $x1 = "Skip call to PackageRideArea().  Payload has already been packaged. Options -x and -q ignored." fullword ascii
      $s2 = "ERROR: pGvars->pIntRideAreaImplantPayload is NULL" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 600KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17__NameProbe_SMBTOUCH_14
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "DEC Pathworks TCPIP service on Windows NT" fullword ascii
      $s2 = "<\\\\__MSBROWSE__> G" fullword ascii
      $s3 = "<IRISNAMESERVER>" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17__NameProbe_SMBTOUCH_14 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      super_rule = 1
      hash1 = "fbe3a[PII_REDACTED]f502a93f51b298ff3abf4e4cad34ce4ec0fad5cb5c2071597"
      hash2 = "7da350c964ea43c149a12ac3d2ce4675cedc079ddc10d1f7c464b[PII_REDACTED]"
      id = "b3b7037b-d08e-5b32-93ec-870f8ce088ac"
   strings:
      $s1 = "DEC Pathworks TCPIP service on Windows NT" fullword ascii
      $s2 = "<\\\\__MSBROWSE__> G" fullword ascii
      $s3 = "<IRISNAMESERVER>" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_RPC2_15
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "** SendAndReceive ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
      $s8 = "Binding to RPC Interface %s over named pipe" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_RPC2_15 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      super_rule = 1
      hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
      hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
      hash3 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
      hash4 = "5c0896dbafc5d8cc19b1bc7924420b20ed5999ac5bee2cb5a91aada0ea01e337"
      id = "f671a10d-f0b8-5343-97b5-e60b7f2f0acf"
   strings:
      $x1 = "** SendAndReceive ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
      $s8 = "Binding to RPC Interface %s over named pipe" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_16
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "ERROR: TbMalloc() failed for encoded exploit payload" fullword ascii
      $x2 = "** EncodeExploitPayload ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
      $x4 = "** RunExploit ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
      $s6 = "Sending Implant Payload (%d-bytes)" fullword ascii
      $s7 = "ERROR: Encoder failed on exploit payload" fullword ascii
      $s11 = "ERROR: VulnerableOS() != RET_SUCCESS" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_16 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      super_rule = 1
      hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
      hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
      hash3 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
      id = "2749227b-13e2-5669-a557-567ebd170a2f"
   strings:
      $x1 = "ERROR: TbMalloc() failed for encoded exploit payload" fullword ascii
      $x2 = "** EncodeExploitPayload ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
      $x4 = "** RunExploit ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
      $s6 = "Sending Implant Payload (%d-bytes)" fullword ascii
      $s7 = "ERROR: Encoder failed on exploit payload" fullword ascii
      $s11 = "ERROR: VulnerableOS() != RET_SUCCESS" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17__ETBL_ETRE_SMBTOUCH_17
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "ERROR: Connection terminated by Target (TCP Ack/Fin)" fullword ascii
      $s2 = "Target did not respond within specified amount of time" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17__ETBL_ETRE_SMBTOUCH_17 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      super_rule = 1
      hash1 = "70db3ac2c1a10de6ce6b3e7a7890c37bffde006ea6d441f5de6d8329add4d2ef"
      hash2 = "e0f05f26293e3231e4e32916ad8a6ee944af842410c194fce8a0d8ad2f5c54b2"
      hash3 = "7da350c964ea43c149a12ac3d2ce4675cedc079ddc10d1f7c464b[PII_REDACTED]"
      id = "88bf610d-1c6e-554a-af82-46b5eb3cc6a5"
   strings:
      $x1 = "ERROR: Connection terminated by Target (TCP Ack/Fin)" fullword ascii
      $s2 = "Target did not respond within specified amount of time" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them )
}
YARA Detection Rule: EquationGroup_scanner_output
Repository: Neo23x0/signature-base
Detects: Detects output generated by EQGRP scanner.exe
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s0 = "# scanning ip  " ascii
      $s1 = "# Scan for windows boxes" ascii fullword
      $s2 = "Going into send" ascii fullword
      $s3 = "# Does not work" ascii fullword
      $s4 = "You are the weakest link, goodbye" ascii fullword
      $s5 = "rpc   Scan for RPC  folks" ascii fullword

Detection condition:
filesize < 1000KB and 2 of them

Full rule:
rule EquationGroup_scanner_output {
   meta:
      description = "Detects output generated by EQGRP scanner.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-04-17"
      id = "a73bc98f-f7b1-5f16-bf23-1d5c9a7a371b"
   strings:
      $s0 = "# scanning ip  " ascii
      $s1 = "# Scan for windows boxes" ascii fullword
      $s2 = "Going into send" ascii fullword
      $s3 = "# Does not work" ascii fullword
      $s4 = "You are the weakest link, goodbye" ascii fullword
      $s5 = "rpc   Scan for RPC  folks" ascii fullword
   condition:
      filesize < 1000KB and 2 of them
}
YARA Detection Rule: SUSP_LNK_Embedded_WordDoc
Repository: Neo23x0/signature-base
Detects: check for LNK files with indications of the Word program or an embedded doc
Author: Greg Lesnewich

Pattern signatures:
$doc_header = {D0 CF 11 E0 A1 B1 1A E1}
		$icon_loc = "C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.exe" ascii wide

Detection condition:
uint32be(0x0) == 0x4C000000 and
		filesize > 10KB and
		any of them

Full rule:
rule SUSP_LNK_Embedded_WordDoc {
	meta:
		author = "Greg Lesnewich"
		description = "check for LNK files with indications of the Word program or an embedded doc"
		date = "2023-01-02"
		version = "1.0"
		hash = "120ca851663ef0ebef585d716c9e2ba67bd[PII_REDACTED]fec3b853156be1159c5"
		DaysofYARA = "2/100"

		id = "9677d41a-9d29-510c-98cd-122dc0ca9606"
	strings:
		$doc_header = {D0 CF 11 E0 A1 B1 1A E1}
		$icon_loc = "C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.exe" ascii wide
	condition:
		uint32be(0x0) == 0x4C000000 and
		filesize > 10KB and
		any of them
}
YARA Detection Rule: SUSP_LNK_SmallScreenSize
Repository: Neo23x0/signature-base
Detects: check for LNKs that have a screen buffer size and WindowSize dimensions of 1x1
Author: Greg Lesnewich

Pattern signatures:
$dimensions = {02 00 00 A0 ?? 00 ?? ?? 01 00 01 00 01}
		// struct ConsoleDataBlock sConsoleDataBlock
		// uint32 Size
		// uint32 Signature
		// enum FillAttributes
		// enum PopupFillAttributes
		// uint16 ScreenBufferSizeX
		// uint16 ScreenBufferSizeY
		// uint16 WindowSizeX
		// uint16 WindowSizeY

Detection condition:
uint32be(0x0) == 0x4c000000 and all of them

Full rule:
rule SUSP_LNK_SmallScreenSize {
	meta:
		author = "Greg Lesnewich"
		description = "check for LNKs that have a screen buffer size and WindowSize dimensions of 1x1"
		date = "2023-01-01"
		version = "1.0"
		DaysofYARA = "1/100"

		id = "6194a76b-36d6-51d1-8d53-2e11172e29d2"
	strings:
		$dimensions = {02 00 00 A0 ?? 00 ?? ?? 01 00 01 00 01}
		// struct ConsoleDataBlock sConsoleDataBlock
		// uint32 Size
		// uint32 Signature
		// enum FillAttributes
		// enum PopupFillAttributes
		// uint16 ScreenBufferSizeX
		// uint16 ScreenBufferSizeY
		// uint16 WindowSizeX
		// uint16 WindowSizeY
	condition:
		uint32be(0x0) == 0x4c000000 and all of them
}
YARA Detection Rule: MAL_Janicab_LNK
Repository: Neo23x0/signature-base
Detects: detect LNK files used in Janicab infection chain
Author: Greg Lesnewich

Pattern signatures:
$j_pdf1 = "%PDF-1.5" ascii wide
		$j_cmd = "\\Windows\\System32\\cmd.exe" ascii wide
		$j_pdf_stream = "endstream" ascii wide
		$j_pdb_obj = "endobj" ascii wide
		$dimensions = {02 00 00 A0 ?? 00 ?? ?? 01 00 01 00 01}

Detection condition:
uint32be(0x0) == 0x4C000000 and $dimensions and 2 of ($j_*)

Full rule:
rule MAL_Janicab_LNK {
	meta:
		author = "Greg Lesnewich"
		description = "detect LNK files used in Janicab infection chain"
		date = "2023-01-01"
		version = "1.0"
		hash = "0c7e8427ee[PII_REDACTED]3e51bf03e0bcf6f2e9c01d2524d82677b20264b23a3f"
		hash = "22ede766fba7551ad0b71ef568d0e5022378eadbdff55c4a02b42e63fcb3b17c"
		hash = "4920e6506ca557d486e6785cb5f7e4b0f4505709ffe8c30070909b040d3c3840"
		hash = "880607cc2da4c3213ea687dabd7707736a879cc5f2f1d4accf79821e4d24d870"
		hash = "f4610b65eba977b3d13eba5da0e38788a9e796a3e9775dd2b8e37b3085c2e1af"
		DaysofYARA = "1/100"

		id = "c21844d3-eeee-530e-a69c-b7f604616f0b"
	strings:
		$j_pdf1 = "%PDF-1.5" ascii wide
		$j_cmd = "\\Windows\\System32\\cmd.exe" ascii wide
		$j_pdf_stream = "endstream" ascii wide
		$j_pdb_obj = "endobj" ascii wide
		$dimensions = {02 00 00 A0 ?? 00 ?? ?? 01 00 01 00 01}
	condition:
		uint32be(0x0) == 0x4C000000 and $dimensions and 2 of ($j_*)
}
YARA Detection Rule: SUSP_ELF_Invalid_Version
Repository: Neo23x0/signature-base
Detects: Identify ELF file that has mangled header info.
Author: @shellcromancer
Reference: https://tmpout.sh/1/1.html

Detection condition:
(
         uint32(0) == 0x464c457f
         and uint8(0x6) > 1 // ELF Version is greater value than in spec.
      )

Full rule:
rule SUSP_ELF_Invalid_Version {
   meta:
      desc = "Identify ELF file that has mangled header info."
      author = "@shellcromancer"
      version = "0.1"
      score = 55
      last_modified = "2023.01.01"
      reference = "https://n0.lol/ebm/1.html"
      reference = "https://tmpout.sh/1/1.html"
      hash = "05379bbf3f46e05d385bbd853d33a13e7e5d7d50"
      id = "5bd97fdd-0912-5f9b-877c-91fff9b98dea"
   condition:
      (
         uint32(0) == 0x464c457f
         and uint8(0x6) > 1 // ELF Version is greater value than in spec.
      )
}
YARA Detection Rule: MAL_ELF_TorchTriton
Repository: Neo23x0/signature-base
Detects: Detection for backdoor (TorchTriton) distributed with a nightly build of PyTorch
Author: Silas Cutler
Reference: https://www.bleepingcomputer.com/news/security/pytorch-discloses-malicious-dependency-chain-compromise-over-holidays/

Pattern signatures:
$error = "failed to send packet"
		$aes_key = "gIdk8tzrHLOM)mPY-R)QgG[;yRXYCZFU"
		$aes_iv = "?BVsNqL]S.Ni"
			// std::vector<std::__cxx11::basic_string<char> > splitIntoDomains(const string&, const string&, const string&)
		$func01 = "splitIntoDomains("
		$func02 = "packageForTransport"
		$func03 = "gatherFiles"
			// void sendFile(const string&, const string&, int, int, const string&)
		$func04 = "void sendFile("
		//enc Domain
		$domain = "&z-%`-(*"

Detection condition:
uint32(0) == 0x464c457f and (
			(all of ($aes_*)) or
			(all of ($func*) and $error) or
			($domain and 2 of them)
			)

Full rule:
rule MAL_ELF_TorchTriton {
	meta:
		author = "Silas Cutler"
		description = "Detection for backdoor (TorchTriton) distributed with a nightly build of PyTorch"
		date = "2023-01-02"
		version = "1.0"
		hash = "2385b29489cd9e35f92c072780f903ae2e517ed422eae67246ae50a5cc738a0e"
		reference = "https://www.bleepingcomputer.com/news/security/pytorch-discloses-malicious-dependency-chain-compromise-over-holidays/"
		DaysofYARA = "2/100"

		id = "85e98ee7-30bf-554f-a0ac-9df263e6dfe4"
	strings:
		$error = "failed to send packet"
		$aes_key = "gIdk8tzrHLOM)mPY-R)QgG[;yRXYCZFU"
		$aes_iv = "?BVsNqL]S.Ni"
			// std::vector<std::__cxx11::basic_string<char> > splitIntoDomains(const string&, const string&, const string&)
		$func01 = "splitIntoDomains("
		$func02 = "packageForTransport"
		$func03 = "gatherFiles"
			// void sendFile(const string&, const string&, int, int, const string&)
		$func04 = "void sendFile("
		//enc Domain
		$domain = "&z-%`-(*"
	condition:
		uint32(0) == 0x464c457f and (
			(all of ($aes_*)) or
			(all of ($func*) and $error) or
			($domain and 2 of them)
			)
}