deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Apolmy_Privesc_Trojan
Repository: Neo23x0/signature-base
Detects: Apolmy Privilege Escalation Trojan used in APT Terracotta
Author: Florian Roth (Nextron Systems)
Reference: https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/

Pattern signatures:
$s1 = "[%d] Failed, %08X" fullword ascii
		$s2 = "[%d] Offset can not fetched." fullword ascii
		$s3 = "PowerShadow2011" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and all of them

Full rule:
rule Apolmy_Privesc_Trojan {
	meta:
		description = "Apolmy Privilege Escalation Trojan used in APT Terracotta"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
		date = "2015-08-04"
		score = 80
		hash = "d7bd289e6cee228eb46a1be1fcdc3a2bd5251bc1eafb59f[PII_REDACTED]d8f373d"
		id = "2f3f496b-ebfe-5a6e-89ad-a24af6378fd7"
	strings:
		$s1 = "[%d] Failed, %08X" fullword ascii
		$s2 = "[%d] Offset can not fetched." fullword ascii
		$s3 = "PowerShadow2011" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 300KB and all of them
}
YARA Detection Rule: Mithozhan_Trojan
Repository: Neo23x0/signature-base
Detects: Mitozhan Trojan used in APT Terracotta
Author: Florian Roth (Nextron Systems)
Reference: https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/

Pattern signatures:
$s1 = "adbrowser" fullword wide 
		$s2 = "IJKLlGdmaWhram0vn36BgIOChYR3L45xcHNydXQvhmloa2ptbH8voYCDTw==" fullword ascii
		$s3 = "EFGHlGdmaWhrL41sf36BgIOCL6R3dk8=" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and all of them

Full rule:
rule Mithozhan_Trojan {
	meta:
		description = "Mitozhan Trojan used in APT Terracotta"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
		date = "2015-08-04"
		score = 70
		hash = "8553b945e2d4b9f45c438797d6b5e73cfe2899af1f9fd87593af4fd7fb51794a"
		id = "5e2b4e08-1a35-5eb0-8c25-a73d45b0e279"
	strings:
		$s1 = "adbrowser" fullword wide 
		$s2 = "IJKLlGdmaWhram0vn36BgIOChYR3L45xcHNydXQvhmloa2ptbH8voYCDTw==" fullword ascii
		$s3 = "EFGHlGdmaWhrL41sf36BgIOCL6R3dk8=" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 300KB and all of them
}
YARA Detection Rule: RemoteExec_Tool
Repository: Neo23x0/signature-base
Detects: Remote Access Tool used in APT Terracotta
Author: Florian Roth (Nextron Systems)
Reference: https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/

Pattern signatures:
$s0 = "cmd.exe /q /c \"%s\"" fullword ascii 
		$s1 = "\\\\.\\pipe\\%s%s%d" fullword ascii 
		$s2 = "This is a service executable! Couldn't start directly." fullword ascii 
		$s3 = "\\\\.\\pipe\\TermHlp_communicaton" fullword ascii 
		$s4 = "TermHlp_stdout" fullword ascii 
		$s5 = "TermHlp_stdin" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 75KB and 4 of ($s*)

Full rule:
rule RemoteExec_Tool {
	meta:
		description = "Remote Access Tool used in APT Terracotta"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
		date = "2015-08-04"
		hash = "a550131e106ff3c703666f15d55d9bc8c816d1cb9ac1b73c2e29f8aa01e53b78"
		id = "c3[PII_REDACTED]-554c-88fc-b523352efe7f"
	strings:
		$s0 = "cmd.exe /q /c \"%s\"" fullword ascii 
		$s1 = "\\\\.\\pipe\\%s%s%d" fullword ascii 
		$s2 = "This is a service executable! Couldn't start directly." fullword ascii 
		$s3 = "\\\\.\\pipe\\TermHlp_communicaton" fullword ascii 
		$s4 = "TermHlp_stdout" fullword ascii 
		$s5 = "TermHlp_stdin" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 75KB and 4 of ($s*)
}
YARA Detection Rule: LiuDoor_Malware_1
Repository: Neo23x0/signature-base
Detects: Liudoor Trojan used in Terracotta APT
Author: Florian Roth (Nextron Systems)
Reference: https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/

Pattern signatures:
$s1 = "svchostdllserver.dll" fullword ascii 
		$s2 = "SvcHostDLL: RegisterServiceCtrlHandler %S failed" fullword ascii 
		$s3 = "\\nbtstat.exe" ascii
		$s4 = "DataVersionEx" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 150KB and all of them

Full rule:
rule LiuDoor_Malware_1 {
	meta:
		description = "Liudoor Trojan used in Terracotta APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
		date = "2015-08-04"
		score = 70
		super_rule = 1
		hash1 = "deed6e2a[PII_REDACTED]3d[PII_REDACTED]e1dfc3ad4589f6987388de13e33ac187fc"
		hash2 = "4575e7fc8f156d1d499aab5064a4832953cd43795574b4c7b9165cdc92993ce5"
		hash3 = "ad1a507709c75fe93708ce9ca1227c5fefa812997ed9104ff9adfec62a3ec2bb"
		id = "ebd5833e-1f5c-5166-aaba-d0be64829e6c"
	strings:
		$s1 = "svchostdllserver.dll" fullword ascii 
		$s2 = "SvcHostDLL: RegisterServiceCtrlHandler %S failed" fullword ascii 
		$s3 = "\\nbtstat.exe" ascii
		$s4 = "DataVersionEx" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 150KB and all of them
}
YARA Detection Rule: LiuDoor_Malware_2
Repository: Neo23x0/signature-base
Detects: Liudoor Trojan used in Terracotta APT
Author: Florian Roth (Nextron Systems)
Reference: https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/

Pattern signatures:
$s0 = "svchostdllserver.dll" fullword ascii 
		$s1 = "Lpykh~mzCCRv|mplpykCCHvq{phlCC\\jmmzqkIzmlvpqCC" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and all of them

Full rule:
rule LiuDoor_Malware_2 {
	meta:
		description = "Liudoor Trojan used in Terracotta APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
		date = "2015-08-04"
		score = 70
		super_rule = 1
		hash1 = "f3fb68b21490ded2ae7327271d3412fbbf9d705c8003a195a705c47c98b43800"
		hash2 = "e42b8385e1aecd89a94a740a2c7cd5ef157b091fabd52cd6f86e47534ca2863e"
		id = "30b9d727-ec77-5ead-80dd-6d442478e78b"
	strings:
		$s0 = "svchostdllserver.dll" fullword ascii 
		$s1 = "Lpykh~mzCCRv|mplpykCCHvq{phlCC\\jmmzqkIzmlvpqCC" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and all of them
}
YARA Detection Rule: EXPL_Office_TemplateInjection_Aug19
Repository: Neo23x0/signature-base
Detects: Detects possible template injections in Office documents, particularly those that load content from external sources
Author: Florian Roth
Reference: https://attack.mitre.org/techniques/T1221/

Pattern signatures:
$x1 = /attachedTemplate" Target="http[s]?:\/\/[^"]{4,60}/ ascii

      $fp1 = ".sharepoint.com"  // this could cause false negatives if the malicious template is hosted on sharepoint
      $fp2 = ".office.com"  // this could cause false negatives if the malicious template is hosted on office.com

Detection condition:
filesize < 20MB
      and $x1
      and not 1 of ($fp*)

Full rule:
rule EXPL_Office_TemplateInjection_Aug19 {
   meta:
      old_rule_name = "EXPL_Office_TemplateInjection"
      description = "Detects possible template injections in Office documents, particularly those that load content from external sources"
      author = "Florian Roth"
      reference = "https://attack.mitre.org/techniques/T1221/"
      date = "2019-08-22"
      modified = "2025-03-20"
      score = 75
      hash = "f2bdf3716b39d29a9c6c3b7b3355e935594b8d8e9149a784a59dc2381fa1628a"
   strings:
      $x1 = /attachedTemplate" Target="http[s]?:\/\/[^"]{4,60}/ ascii

      $fp1 = ".sharepoint.com"  // this could cause false negatives if the malicious template is hosted on sharepoint
      $fp2 = ".office.com"  // this could cause false negatives if the malicious template is hosted on office.com
   condition:
      filesize < 20MB
      and $x1
      and not 1 of ($fp*)
}
YARA Detection Rule: KasperMalware_Oct17_1
Repository: Neo23x0/signature-base
Detects: Detects Kasper Backdoor
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "\\Release\\kasper.pdb" ascii
      $x2 = "C:\\D@oc@um@en@ts a@nd Set@tings\\Al@l Users" wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 7000KB and (
         pe.imphash() == "2bceb64cf37acd34bc33b38f2cddfb61" or
         1 of them
      )

Full rule:
rule KasperMalware_Oct17_1 {
   meta:
      description = "Detects Kasper Backdoor"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-10-24"
      hash1 = "758bdaf26a0bd309a5458cb4569fe1c789cf5db087880d6d1676dec051c3a28d"
      id = "7201d8ee-50ee-5a5c-a5b8-ee36c78b0d6e"
   strings:
      $x1 = "\\Release\\kasper.pdb" ascii
      $x2 = "C:\\D@oc@um@en@ts a@nd Set@tings\\Al@l Users" wide
   condition:
      uint16(0) == 0x5a4d and filesize < 7000KB and (
         pe.imphash() == "2bceb64cf37acd34bc33b38f2cddfb61" or
         1 of them
      )
}
YARA Detection Rule: MAL_PE_Type_BabyShark_Loader
Repository: Neo23x0/signature-base
Detects: Detects PE Type babyShark loader mentioned in February 2019 blog post by PaloAltNetworks
Author: Florian Roth (Nextron Systems)
Reference: https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/

Pattern signatures:
$x1 = "reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\" /v AutoRun /t REG_SZ /d \"%s\" /f" fullword ascii
      $x2 = /mshta\.exe http:\/\/[a-z0-9\.\/]{5,30}\.hta/

      $xc1 = { 57 69 6E 45 78 65 63 00 6B 65 72 6E 65 6C 33 32
               2E 44 4C 4C 00 00 00 00 } /* WinExec kernel32.DLL */

Detection condition:
uint16(0) == 0x5a4d and (
         pe.imphash() == "57b6d88707d9cd1c87169076c24f962e" or
         1 of them or
         for any i in (0 .. pe.number_of_signatures) : (
            pe.signatures[i].issuer contains "thawte SHA256 Code Signing CA" and
            pe.signatures[i].serial == "0f:ff:e4:32

Full rule:
rule MAL_PE_Type_BabyShark_Loader {
   meta:
      description = "Detects PE Type babyShark loader mentioned in February 2019 blog post by PaloAltNetworks"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"
      date = "2019-02-24"
      hash1 = "6f76a8e16908ba2d576cf0e8cdb70114dcb70e0f7223be10aab3a728dc65c41c"
      id = "141e7a67-7930-5fd8-ac91-5d31b99e4ff3"
   strings:
      $x1 = "reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\" /v AutoRun /t REG_SZ /d \"%s\" /f" fullword ascii
      $x2 = /mshta\.exe http:\/\/[a-z0-9\.\/]{5,30}\.hta/

      $xc1 = { 57 69 6E 45 78 65 63 00 6B 65 72 6E 65 6C 33 32
               2E 44 4C 4C 00 00 00 00 } /* WinExec kernel32.DLL */
   condition:
      uint16(0) == 0x5a4d and (
         pe.imphash() == "57b6d88707d9cd1c87169076c24f962e" or
         1 of them or
         for any i in (0 .. pe.number_of_signatures) : (
            pe.signatures[i].issuer contains "thawte SHA256 Code Signing CA" and
            pe.signatures[i].serial == "0f:ff:e4:32:a5:3f:f0:3b:92:23:f8:8b:e1:b8:3d:9d"
         )
      )
}
YARA Detection Rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1
Repository: Neo23x0/signature-base
Detects: Detects BabyShark KimJongRAT
Author: Florian Roth (Nextron Systems)
Reference: https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/

Pattern signatures:
$x1 = "%s\\Microsoft\\ttmp.log" fullword wide

      $a1 = "logins.json" fullword ascii

      $s1 = "https://www.google.com/accounts/servicelogin" fullword ascii
      $s2 = "https://login.yahoo.com/config/login" fullword ascii
      $s3 = "SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login" ascii
      $s4 = "\\mozsqlite3.dll" ascii
      $s5 = "SMTP Password" fullword ascii
      $s6 = "Yandex\\YandexBrowser\\User Data\\Default\\Login Data" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 2000KB and (
         1 of ($x*) or
         ( $a1 and 3 of ($s*) )
      )

Full rule:
rule APT_NK_BabyShark_KimJoingRAT_Apr19_1 {
   meta:
      description = "Detects BabyShark KimJongRAT"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/"
      date = "2019-04-27"
      hash1 = "d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712"
      id = "c6bd1e1a-68f2-5a2d-a159-b16ea0d33987"
   strings:
      $x1 = "%s\\Microsoft\\ttmp.log" fullword wide

      $a1 = "logins.json" fullword ascii

      $s1 = "https://www.google.com/accounts/servicelogin" fullword ascii
      $s2 = "https://login.yahoo.com/config/login" fullword ascii
      $s3 = "SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login" ascii
      $s4 = "\\mozsqlite3.dll" ascii
      $s5 = "SMTP Password" fullword ascii
      $s6 = "Yandex\\YandexBrowser\\User Data\\Default\\Login Data" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 2000KB and (
         1 of ($x*) or
         ( $a1 and 3 of ($s*) )
      )
}
YARA Detection Rule: MAL_DNSPIONAGE_Malware_Nov18
Repository: Neo23x0/signature-base
Detects: Detects DNSpionage Malware
Author: Florian Roth (Nextron Systems)
Reference: https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html

Pattern signatures:
$x1 = ".0ffice36o.com" ascii

      $s1 = "/Client/Login?id=" ascii
      $s2 = ".\\Configure.txt" ascii
      $s5 = "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko" fullword ascii
      $s6 = "Content-Disposition: form-data; name=\"txts\"" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) or 2 of them )

Full rule:
rule MAL_DNSPIONAGE_Malware_Nov18 {
   meta:
      description = "Detects DNSpionage Malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html"
      date = "2018-11-30"
      modified = "2023-01-06"
      hash1 = "2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec"
      hash2 = "45a9edb24d4174592c69d9d37a534a518fbe2a88d3817fc0cc739e455883b8ff"
      id = "5a0b498b-b2e9-5827-9908-63586b2cf947"
   strings:
      $x1 = ".0ffice36o.com" ascii

      $s1 = "/Client/Login?id=" ascii
      $s2 = ".\\Configure.txt" ascii
      $s5 = "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko" fullword ascii
      $s6 = "Content-Disposition: form-data; name=\"txts\"" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) or 2 of them )
}
YARA Detection Rule: APT_DNSpionage_Karkoff_Malware_Apr19_1
Repository: Neo23x0/signature-base
Detects: Detects DNSpionage Karkoff malware
Author: Florian Roth (Nextron Systems)
Reference: https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html

Pattern signatures:
$x1 = "Karkoff.exe" fullword wide
      $x2 = "kuternull.com" fullword wide
      $x3 = "rimrun.com" fullword wide

      $s1 = "C:\\Windows\\Temp\\" wide
      $s2 = "CMD.exe" fullword wide
      $s3 = "get_ProcessExtensionDataNames" fullword ascii
      $s4 = "get_ProcessDictionaryKeys" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and (
         1 of ($x*) or
         all of ($s*)
      )

Full rule:
rule APT_DNSpionage_Karkoff_Malware_Apr19_1 {
   meta:
      description = "Detects DNSpionage Karkoff malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html"
      date = "2019-04-24"
      hash1 = "6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11"
      hash2 = "b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04"
      hash3 = "5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c"
      hash4 = "cd4b9d0f2d1c[PII_REDACTED]f0ed352c1ed6d4f512d66e0e44ce[PII_REDACTED]95b5"
      id = "be955760-ae94-5f77-928d-f4118a97ae6a"
   strings:
      $x1 = "Karkoff.exe" fullword wide
      $x2 = "kuternull.com" fullword wide
      $x3 = "rimrun.com" fullword wide

      $s1 = "C:\\Windows\\Temp\\" wide
      $s2 = "CMD.exe" fullword wide
      $s3 = "get_ProcessExtensionDataNames" fullword ascii
      $s4 = "get_ProcessDictionaryKeys" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and (
         1 of ($x*) or
         all of ($s*)
      )
}
YARA Detection Rule: PLEAD_Downloader_Jun18_1
Repository: Neo23x0/signature-base
Detects: Detects PLEAD Downloader
Author: Florian Roth (Nextron Systems)
Reference: https://blog.jpcert.or.jp/2018/06/plead-downloader-used-by-blacktech.html

Pattern signatures:
$s1 = "%02d:%02d:%02d" ascii fullword
      $s2 = "%02d-%02d-%02d" ascii fullword
      $s3 = "1111%02d%02d%02d_%02d%02d2222" ascii fullword
      $a1 = "Scanning..." wide fullword
      $a2 = "Checking..." wide fullword

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and (
            all of ($s*) or
            ( 2 of ($s*) and 1 of ($a*) )
      )

Full rule:
rule PLEAD_Downloader_Jun18_1 {
   meta:
      description = "Detects PLEAD Downloader"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://blog.jpcert.or.jp/2018/06/plead-downloader-used-by-blacktech.html"
      date = "2018-06-16"
      hash1 = "a26df4f62ada084a596bf0f603691bc9c02024be98abec4a9872f0ff0085f940"
      id = "19d588d8-1f03-5f34-b82e-b645c28a19a4"
   strings:
      $s1 = "%02d:%02d:%02d" ascii fullword
      $s2 = "%02d-%02d-%02d" ascii fullword
      $s3 = "1111%02d%02d%02d_%02d%02d2222" ascii fullword
      $a1 = "Scanning..." wide fullword
      $a2 = "Checking..." wide fullword
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and (
            all of ($s*) or
            ( 2 of ($s*) and 1 of ($a*) )
      )
}
YARA Detection Rule: Base64_PS1_Shellcode
Repository: Neo23x0/signature-base
Detects: Detects Base64 encoded PS1 Shellcode
Author: Nick Carr, David Ledbetter
Reference: https://twitter.com/ItsReallyNick/status/[PII_REDACTED]66843392

Pattern signatures:
$substring = "AAAAYInlM"
      $pattern1 = "/OiCAAAAYInlM"
      $pattern2 = "/OiJAAAAYInlM"

Detection condition:
$substring and 1 of ($p*)

Full rule:
rule Base64_PS1_Shellcode {
   meta:
      description = "Detects Base64 encoded PS1 Shellcode"
      author = "Nick Carr, David Ledbetter"
      reference = "https://twitter.com/ItsReallyNick/status/[PII_REDACTED]66843392"
      date = "2018-11-14"
      score = 65
      id = "7c3cec3b-a192-5bfd-b4f1-22b1afeb717e"
   strings:
      $substring = "AAAAYInlM"
      $pattern1 = "/OiCAAAAYInlM"
      $pattern2 = "/OiJAAAAYInlM"
   condition:
      $substring and 1 of ($p*)
}
YARA Detection Rule: p0wnedPowerCat
Repository: Neo23x0/signature-base
Detects: p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedPowerCat.cs
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/Cn33liz/p0wnedShell

Pattern signatures:
$x1 = "Now if we point Firefox to http://127.0.0.1" fullword ascii
      $x2 = "powercat -l -v -p" fullword ascii
      $x3 = "P0wnedListener" fullword ascii
      $x4 = "EncodedPayload.bat" fullword ascii
      $x5 = "powercat -c " fullword ascii
      $x6 = "Program.P0wnedPath()" ascii
      $x7 = "Invoke-PowerShellTcpOneLine" fullword ascii

Detection condition:
( uint16(0) == 0x7375 and filesize < 150KB and 1 of them ) or ( 2 of them )

Full rule:
rule p0wnedPowerCat {
   meta:
      description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedPowerCat.cs"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/Cn33liz/p0wnedShell"
      date = "2017-01-14"
      hash1 = "6a3ba991d3b5d127c4325bc194b3241dde5b3a5853b78b4df1bce7cbe87c0fdf"
      id = "059a8e58-7b7e-582e-ba4a-80e4dffe9b5e"
   strings:
      $x1 = "Now if we point Firefox to http://127.0.0.1" fullword ascii
      $x2 = "powercat -l -v -p" fullword ascii
      $x3 = "P0wnedListener" fullword ascii
      $x4 = "EncodedPayload.bat" fullword ascii
      $x5 = "powercat -c " fullword ascii
      $x6 = "Program.P0wnedPath()" ascii
      $x7 = "Invoke-PowerShellTcpOneLine" fullword ascii
   condition:
      ( uint16(0) == 0x7375 and filesize < 150KB and 1 of them ) or ( 2 of them )
}
YARA Detection Rule: Hacktool_Strings_p0wnedShell
Repository: Neo23x0/signature-base
Detects: Detects strings found in Runspace Post Exploitation Toolkit
Author: Florian Roth
Reference: https://github.com/Cn33liz/p0wnedShell

Pattern signatures:
$x1 = "Invoke-TokenManipulation" fullword ascii
      $x2 = "windows/meterpreter" fullword ascii
      $x3 = "lsadump::dcsync" fullword ascii
      $x4 = "p0wnedShellx86" fullword ascii
      $x5 = "p0wnedShellx64" fullword ascii
      $x6 = "Invoke_PsExec()" fullword ascii
      $x7 = "Invoke-Mimikatz" fullword ascii
      $x8 = "Invoke_Shellcode()" fullword ascii
      $x9 = "Invoke-ReflectivePEInjection" ascii

      $fp1 = "Sentinel Labs, Inc." wide
      $fp2 = "Copyright Elasticsearch B.V." ascii wide
      $fp3 = "Attack Information: Invoke-Mimikatz" ascii /* Check Point help files */
      $fp4 = "a30226 || INDICATOR-SHELLCODE Metasploit windows/meterpreter stage transfer attempt" /* snort message ID */
      $fp5 = "use strict"

Detection condition:
filesize < 20MB
      and 1 of ($x*)
      and not 1 of ($fp*)

Full rule:
rule Hacktool_Strings_p0wnedShell : FILE {
   meta:
      description = "Detects strings found in Runspace Post Exploitation Toolkit"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth"
      reference = "https://github.com/Cn33liz/p0wnedShell"
      date = "2017-01-14"
      modified = "2023-02-10"
      hash1 = "e1f[PII_REDACTED]6cd79e60dba0521fc6eb107f3e65741c344832c46e9b4085e60"
      nodeepdive = 1
      id = "0846039d-1e00-5224-9560-55ab18034d54"
   strings:
      $x1 = "Invoke-TokenManipulation" fullword ascii
      $x2 = "windows/meterpreter" fullword ascii
      $x3 = "lsadump::dcsync" fullword ascii
      $x4 = "p0wnedShellx86" fullword ascii
      $x5 = "p0wnedShellx64" fullword ascii
      $x6 = "Invoke_PsExec()" fullword ascii
      $x7 = "Invoke-Mimikatz" fullword ascii
      $x8 = "Invoke_Shellcode()" fullword ascii
      $x9 = "Invoke-ReflectivePEInjection" ascii

      $fp1 = "Sentinel Labs, Inc." wide
      $fp2 = "Copyright Elasticsearch B.V." ascii wide
      $fp3 = "Attack Information: Invoke-Mimikatz" ascii /* Check Point help files */
      $fp4 = "a30226 || INDICATOR-SHELLCODE Metasploit windows/meterpreter stage transfer attempt" /* snort message ID */
      $fp5 = "use strict"
   condition:
      filesize < 20MB
      and 1 of ($x*)
      and not 1 of ($fp*)
}