deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: MAL_APT_NK_Andariel_GoLang_Validalpha_BlackString
Repository: Neo23x0/signature-base
Detects: Detects a variant of the GoLang Validalpha malware based on a file path found in the samples
Author: CISA.gov
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

Pattern signatures:
$ = "I:/01___Tools/02__RAT/Black"

Detection condition:
uint16(0) == 0x5A4D and all of them

Full rule:
rule MAL_APT_NK_Andariel_GoLang_Validalpha_BlackString {
   meta:
      author = "CISA.gov"
      description = "Detects a variant of the GoLang Validalpha malware based on a file path found in the samples"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
      date = "2024-07-25"
      score = 90
      id = "36f46a1d-69b6-5c99-9a54-6a14d62d2721"
   strings:
      $ = "I:/01___Tools/02__RAT/Black"
   condition:
      uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: MAL_APT_NK_INDICATOR_EXE_Packed_VMProtect
Repository: Neo23x0/signature-base

Pattern signatures:
$s1 = ".vmp0" fullword ascii
        $s2 = ".vmp1" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and all of them or
        for any i in (0 .. pe.number_of_sections) : (
            (
                pe.sections[i].name == ".vmp0" or
                pe.sections[i].name == ".vmp1"
            )
        )

Full rule:
rule MAL_APT_NK_INDICATOR_EXE_Packed_VMProtect {
        strings:
        $s1 = ".vmp0" fullword ascii
        $s2 = ".vmp1" fullword ascii
    condition:
        uint16(0) == 0x5a4d and all of them or
        for any i in (0 .. pe.number_of_sections) : (
            (
                pe.sections[i].name == ".vmp0" or
                pe.sections[i].name == ".vmp1"
            )
        )
}
YARA Detection Rule: MAL_APT_NK_INDICATOR_EXE_Packed_Themida
Repository: Neo23x0/signature-base

Pattern signatures:
$s1 = ".themida" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and all of them or
        for any i in (0 .. pe.number_of_sections) : (
            (
                pe.sections[i].name == ".themida"
            )
        )

Full rule:
rule MAL_APT_NK_INDICATOR_EXE_Packed_Themida {
        strings:
        $s1 = ".themida" fullword ascii
    condition:
        uint16(0) == 0x5a4d and all of them or
        for any i in (0 .. pe.number_of_sections) : (
            (
                pe.sections[i].name == ".themida"
            )
        )
}
YARA Detection Rule: MAL_APT_NK_Andariel_ELF_Backdoor_Fipps
Repository: Neo23x0/signature-base
Detects: Detects a Linux backdoor named Fipps used by Andariel
Author: CISA.gov
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

Pattern signatures:
$a = "found mac address"
      $b = "RecvThread"
      $c = "OpenSSL-1.0.0-fipps"
      $d = "Disconnected!"

Detection condition:
uint32(0) == 0x464c457f
      and all of them

Full rule:
rule MAL_APT_NK_Andariel_ELF_Backdoor_Fipps {
   meta:
      author = "CISA.gov"
      description = "Detects a Linux backdoor named Fipps used by Andariel"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
      date = "2024-07-25"
      score = 80
      id = "040bca78-8b7e-5397-8a2b-1ddeed59eea3"
   strings:
      $a = "found mac address"
      $b = "RecvThread"
      $c = "OpenSSL-1.0.0-fipps"
      $d = "Disconnected!"
   condition:
      uint32(0) == 0x464c457f
      and all of them
}
YARA Detection Rule: MAL_APT_NK_Andariel_BindShell
Repository: Neo23x0/signature-base
Detects: Detects a BindShell used by Andariel
Author: CISA.gov
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

Pattern signatures:
$str_comspec = "COMSPEC"
      $str_consolewindow = "GetConsoleWindow"
      $str_ShowWindow = "ShowWindow"
      $str_WSASocketA = "WSASocketA"
      $str_CreateProcessA = "CreateProcessA"
      $str_port = { B9 4D 05 00 00 89 }

Detection condition:
uint16(0) == 0x5A4D
      and all of them

Full rule:
rule MAL_APT_NK_Andariel_BindShell {
   meta:
      author = "CISA.gov"
      description = "Detects a BindShell used by Andariel"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
      date = "2024-07-25"
      modified = "2026-01-29"
      score = 50  // prone to FPs
      id = "3f6d83da-cea5-5e12-b0ba-93ace09d3d5c"
   strings:
      $str_comspec = "COMSPEC"
      $str_consolewindow = "GetConsoleWindow"
      $str_ShowWindow = "ShowWindow"
      $str_WSASocketA = "WSASocketA"
      $str_CreateProcessA = "CreateProcessA"
      $str_port = { B9 4D 05 00 00 89 }
   condition:
      uint16(0) == 0x5A4D
      and all of them
}
YARA Detection Rule: MAL_APT_NK_Andariel_Grease2
Repository: Neo23x0/signature-base
Detects: Detects the Grease2 malware family used by Andariel
Author: CISA.gov (modified by Florian Roth, Nextron Systems)
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

Pattern signatures:
/* I bet this was an error and fixed the strings - I allow you to kick my butt when I'm wrong
      $str_rdpconf = "c: \\windows\\temp\\RDPConf.exe" fullword nocase
      $str_rdpwinst = "c: \\windows\\temp\\RDPWInst.exe" fullword nocase
      */
      $str_rdpconf = "emp\\RDPConf.exe"  // I removed the beginning of the string because the spaces looked like an error and I don't want to use nocase here, F.R.
      $str_rdpwinst = "emp\\RDPWInst.exe"
      $str_net_user = "net user"
      $str_admins_add = "net localgroup administrators"

Detection condition:
uint16(0) == 0x5A4D and
      all of them

Full rule:
rule MAL_APT_NK_Andariel_Grease2 {
   meta:
      author = "CISA.gov (modified by Florian Roth, Nextron Systems)"
      description = "Detects the Grease2 malware family used by Andariel"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
      date = "2024-07-25"
      modified = "2024-07-26"
      score = 80
      id = "4defbe08-b3c6-5ab9-9a57-cec57ff42d9a"
   strings:
      /* I bet this was an error and fixed the strings - I allow you to kick my butt when I'm wrong
      $str_rdpconf = "c: \\windows\\temp\\RDPConf.exe" fullword nocase
      $str_rdpwinst = "c: \\windows\\temp\\RDPWInst.exe" fullword nocase
      */
      $str_rdpconf = "emp\\RDPConf.exe"  // I removed the beginning of the string because the spaces looked like an error and I don't want to use nocase here, F.R.
      $str_rdpwinst = "emp\\RDPWInst.exe"
      $str_net_user = "net user"
      $str_admins_add = "net localgroup administrators"
   condition:
      uint16(0) == 0x5A4D and
      all of them
}
YARA Detection Rule: MAL_APT_NK_Andariel_NoPineapple_Dtrack_Unpacked
Repository: Neo23x0/signature-base
Detects: Detects the Dtrack variant used by Andariel
Author: CISA.gov
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

Pattern signatures:
$str_nopineapple = "< No Pineapple! >"
      $str_qt_library = "Qt 5.12.10"
      $str_xor = { 8B 10 83 F6 ?? 83 FA 01 77 }

Detection condition:
uint16(0) == 0x5A4D
      and all of them

Full rule:
rule MAL_APT_NK_Andariel_NoPineapple_Dtrack_Unpacked {
   meta:
      author = "CISA.gov"
      description = "Detects the Dtrack variant used by Andariel"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
      date = "2024-07-25"
      score = 80
      id = "6ccaf24b-c110-5788-a792-fa7f39fb18f7"
   strings:
      $str_nopineapple = "< No Pineapple! >"
      $str_qt_library = "Qt 5.12.10"
      $str_xor = { 8B 10 83 F6 ?? 83 FA 01 77 }
   condition:
      uint16(0) == 0x5A4D
      and all of them
}
YARA Detection Rule: MAL_APT_NK_Andariel_DTrack_Unpacked
Repository: Neo23x0/signature-base
Detects: Detects DTrack variant used by Andariel
Author: CISA.gov (modified by Florian Roth, Nextron Systems)
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

Pattern signatures:
$x_str_cmd_4 = "/c systeminfo > \"%s\" & tasklist > \"%s\" & netstat -naop tcp > \"%s\"" wide
      $x_str_cmd_2 = "/c ping -n 3 127.0.01 > NUL % echo EEE > \"%s\"" wide

      $str_mutex = "MTX_Global"
      $str_cmd_1 = "/c net use \\\\" wide
      $str_cmd_3 = "/c move /y %s \\\\" wide

Detection condition:
// I changed the condition here because there are two strings which are highly specific and unique, F.R.
      uint16(0) == 0x5A4D
      and (
         1 of ($x*)
         or 3 of them
      )

Full rule:
rule MAL_APT_NK_Andariel_DTrack_Unpacked {
   meta:
      author = "CISA.gov (modified by Florian Roth, Nextron Systems)"
      description = "Detects DTrack variant used by Andariel"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
      date = "2024-07-25"
      modified = "2024-07-26"
      score = 75
      id = "0c161275-2b2e-51a4-9e08-c118fb4c8671"
   strings:
      $x_str_cmd_4 = "/c systeminfo > \"%s\" & tasklist > \"%s\" & netstat -naop tcp > \"%s\"" wide
      $x_str_cmd_2 = "/c ping -n 3 127.0.01 > NUL % echo EEE > \"%s\"" wide

      $str_mutex = "MTX_Global"
      $str_cmd_1 = "/c net use \\\\" wide
      $str_cmd_3 = "/c move /y %s \\\\" wide
   condition:
      // I changed the condition here because there are two strings which are highly specific and unique, F.R.
      uint16(0) == 0x5A4D
      and (
         1 of ($x*)
         or 3 of them
      )
}
YARA Detection Rule: MAL_APT_NK_Andariel_TigerRAT_Crowdsourced_Rule
Repository: Neo23x0/signature-base
Detects: Detects the Tiger RAT variant used by Andariel
Author: CISA.gov (modified by Florian Roth, Nextron Systems)
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

Pattern signatures:
$m1 = ".?AVModuleKeyLogger@@" fullword ascii
      $m2 = ".?AVModulePortForwarder@@" fullword ascii
      $m3 = ".?AVModuleScreenCapture@@" fullword ascii
      $m4 = ".?AVModuleShell@@" fullword ascii

      $s1 = "\\x9891-009942-xnopcopie.dat" fullword wide
      $s2 = "(%02d : %02d-%02d %02d:%02d:%02d)--- %s[Clipboard]" fullword ascii
      $s3 = "[%02d : %02d-%02d %02d:%02d:%02d]--- %s[Title]" fullword ascii
      $s4 = "del \"%s\"%s \"%s\" goto " ascii
   // $s5 = "[<<]" fullword ascii  // we don't need that short string and the rule probably doesn't lose anything without it, F.R.

Detection condition:
uint16(0) == 0x5a4d and (
         all of ($s*) or (
            all of ($m*) and 1 of ($s*)
         )
         or (
            2 of ($m*) and 2 of ($s*)
         )
      )

Full rule:
rule MAL_APT_NK_Andariel_TigerRAT_Crowdsourced_Rule {
   meta:
      author = "CISA.gov (modified by Florian Roth, Nextron Systems)"
      description = "Detects the Tiger RAT variant used by Andariel"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
      date = "2024-07-25"
      modified = "2024-07-26"
      score = 75
      id = "6be65222-7d3c-5ff5-a9c7-d91dcf1deaa6"
   strings:
      $m1 = ".?AVModuleKeyLogger@@" fullword ascii
      $m2 = ".?AVModulePortForwarder@@" fullword ascii
      $m3 = ".?AVModuleScreenCapture@@" fullword ascii
      $m4 = ".?AVModuleShell@@" fullword ascii

      $s1 = "\\x9891-009942-xnopcopie.dat" fullword wide
      $s2 = "(%02d : %02d-%02d %02d:%02d:%02d)--- %s[Clipboard]" fullword ascii
      $s3 = "[%02d : %02d-%02d %02d:%02d:%02d]--- %s[Title]" fullword ascii
      $s4 = "del \"%s\"%s \"%s\" goto " ascii
   // $s5 = "[<<]" fullword ascii  // we don't need that short string and the rule probably doesn't lose anything without it, F.R.
   condition:
      uint16(0) == 0x5a4d and (
         all of ($s*) or (
            all of ($m*) and 1 of ($s*)
         )
         or (
            2 of ($m*) and 2 of ($s*)
         )
      )
}
YARA Detection Rule: PHISH_02Dez2015_dropped_p0o6543f_1
Repository: Neo23x0/signature-base
Detects: Phishing Wave - file p0o6543f.exe
Author: Florian Roth (Nextron Systems)
Reference: http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/

Pattern signatures:
$s1 = "netsh.exe" fullword wide
		$s2 = "routemon.exe" fullword wide
		$s3 = "script=" fullword wide /* Goodware String - occured 4 times */
		$s4 = "disconnect" fullword wide /* Goodware String - occured 14 times */
		$s5 = "GetClusterResourceTypeKey" fullword ascii /* Goodware String - occured 17 times */
		$s6 = "QueryInformationJobObject" fullword ascii /* Goodware String - occured 34 times */
		$s7 = "interface" fullword wide /* Goodware String - occured 52 times */
		$s8 = "connect" fullword wide /* Goodware String - occured 61 times */
		$s9 = "FreeConsole" fullword ascii /* Goodware String - occured 91 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 250KB and all of them

Full rule:
rule PHISH_02Dez2015_dropped_p0o6543f_1 {
	meta:
		description = "Phishing Wave - file p0o6543f.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
		date = "2015-12-02"
		hash = "db788d6d3a8ed1a6dc[PII_REDACTED]f475e7671e12fa9c9faa73b7277886f1e210"
		id = "3335ad3c-47f8-5547-bac0-df2d98ff644f"
	strings:
		$s1 = "netsh.exe" fullword wide
		$s2 = "routemon.exe" fullword wide
		$s3 = "script=" fullword wide /* Goodware String - occured 4 times */
		$s4 = "disconnect" fullword wide /* Goodware String - occured 14 times */
		$s5 = "GetClusterResourceTypeKey" fullword ascii /* Goodware String - occured 17 times */
		$s6 = "QueryInformationJobObject" fullword ascii /* Goodware String - occured 34 times */
		$s7 = "interface" fullword wide /* Goodware String - occured 52 times */
		$s8 = "connect" fullword wide /* Goodware String - occured 61 times */
		$s9 = "FreeConsole" fullword ascii /* Goodware String - occured 91 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 250KB and all of them
}
YARA Detection Rule: PHISH_02Dez2015_dropped_p0o6543f_2
Repository: Neo23x0/signature-base
Detects: Phishing Wave used MineExplorer Game by WangLei - file p0o6543f.exe.4
Author: Florian Roth (Nextron Systems)
Reference: http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/

Pattern signatures:
$s1 = "Email: W0067@990.net" fullword wide
		$s2 = "MineExplorer Version 1.0" fullword wide
		$s6 = "Copy Rights by WangLei 1999.4" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 400KB and all of them

Full rule:
rule PHISH_02Dez2015_dropped_p0o6543f_2 {
	meta:
		description = "Phishing Wave used MineExplorer Game by WangLei - file p0o6543f.exe.4"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
		date = "2015-12-03"
		hash1 = "d6b21ded749b57042eede07c3af1956a3c9f1faddd22d2f78e43003a11ae496f"
		hash2 = "561b16643992b92d37cf380bc2ed7cd106e4dcaf25ca45b4ba876ce59533fb02"
		id = "ed6f6dc8-5b5d-5a6f-a2a0-cb8a34c8931f"
	strings:
		$s1 = "Email: W0067@990.net" fullword wide
		$s2 = "MineExplorer Version 1.0" fullword wide
		$s6 = "Copy Rights by WangLei 1999.4" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 400KB and all of them
}
YARA Detection Rule: PHISH_02Dez2015_attach_P_ORD_C_10156_124658
Repository: Neo23x0/signature-base
Detects: Phishing Wave - file P-ORD-C-10156-124658.xls
Author: Florian Roth (Nextron Systems)
Reference: http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/

Pattern signatures:
$s1 = "Execute" ascii
		$s2 = "Process WriteParameterFiles" fullword ascii
		$s3 = "WScript.Shell" fullword ascii
		$s4 = "STOCKMASTER" fullword ascii
		$s5 = "InsertEmailFax" ascii

Detection condition:
uint16(0) == 0xcfd0 and filesize < 200KB and all of them

Full rule:
rule PHISH_02Dez2015_attach_P_ORD_C_10156_124658 {
	meta:
		description = "Phishing Wave - file P-ORD-C-10156-124658.xls"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
		date = "2015-12-02"
		hash1 = "bc252ede5302240c2fef8bc0291ad5a227906b4e70929a737792e935a5fee209"
		hash2 = "e6c5b55586e9d99551adc27a0fc9c080cea6201fae60104b82d5a2ec518fafb6"
		hash3 = "80f278b7268ea6814f8b336e07c5f4b03289519e199fbe4cbd9ef6a38cf25df6"
		hash4 = "3a0a758525883a049a42312e46a023076c31af23b5e8e5b81fec56d51e4c80fb"
		hash5 = "bc252ede5302240c2fef8bc0291ad5a227906b4e70929a737792e935a5fee209"
		hash6 = "d9db7d32949c4df6a5d9d0292b576ae19681be7b6e0684df57338390e87fc6d6"
		hash7 = "7bb705701ae73d377f6091515a140f0af57703719a67da9a60fad4544092ee6c"
		hash8 = "e743c6e7749ab1046a2beea8733d7c8386ea60b43492bb4f0769ced6a2cee66d"
		id = "8989379a-6cd9-52ba-be18-5d402a440758"
	strings:
		$s1 = "Execute" ascii
		$s2 = "Process WriteParameterFiles" fullword ascii
		$s3 = "WScript.Shell" fullword ascii
		$s4 = "STOCKMASTER" fullword ascii
		$s5 = "InsertEmailFax" ascii
	condition:
		uint16(0) == 0xcfd0 and filesize < 200KB and all of them
}
YARA Detection Rule: LOG_EXPL_Confluence_RCE_CVE_2021_26084_Sep21
Repository: Neo23x0/signature-base
Detects: Detects exploitation attempts against Confluence servers abusing a RCE reported as CVE-2021-26084
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md

Pattern signatures:
$xr1 = /isSafeExpression Unsafe clause found in \['[^\n]{1,64}\\u0027/ ascii wide
      $xs1 = "[util.velocity.debug.DebugReferenceInsertionEventHandler] referenceInsert resolving reference [$!queryString]"
      $xs2 = "userName: anonymous | action: createpage-entervariables ognl.ExpressionSyntaxException: Malformed OGNL expression: '\\' [ognl.TokenMgrError: Lexical error at line 1"

      $sa1 = "GET /pages/doenterpagevariables.action"
      $sb1 = "%5c%75%30%30%32%37"
      $sb2 = "\\u0027"

      $sc1 = " ERROR "
      $sc2 = " | userName: anonymous | action: createpage-entervariables"
      $re1 = /\[confluence\.plugins\.synchrony\.SynchronyContextProvider\] getContextMap (\n )?-- url: \/pages\/createpage-entervariables\.action/

Detection condition:
1 of ($x*) or ( $sa1 and 1 of ($sb*) ) or (all of ($sc*) and $re1)

Full rule:
rule LOG_EXPL_Confluence_RCE_CVE_2021_26084_Sep21 : LOG {
   meta:
      description = "Detects exploitation attempts against Confluence servers abusing a RCE reported as CVE-2021-26084"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md"
      date = "2021-09-01"
      score = 55
      id = "bbf98ce4-d32b-541a-b727-bc35c9aaef53"
   strings:
      $xr1 = /isSafeExpression Unsafe clause found in \['[^\n]{1,64}\\u0027/ ascii wide
      $xs1 = "[util.velocity.debug.DebugReferenceInsertionEventHandler] referenceInsert resolving reference [$!queryString]"
      $xs2 = "userName: anonymous | action: createpage-entervariables ognl.ExpressionSyntaxException: Malformed OGNL expression: '\\' [ognl.TokenMgrError: Lexical error at line 1"

      $sa1 = "GET /pages/doenterpagevariables.action"
      $sb1 = "%5c%75%30%30%32%37"
      $sb2 = "\\u0027"

      $sc1 = " ERROR "
      $sc2 = " | userName: anonymous | action: createpage-entervariables"
      $re1 = /\[confluence\.plugins\.synchrony\.SynchronyContextProvider\] getContextMap (\n )?-- url: \/pages\/createpage-entervariables\.action/
   condition:
      1 of ($x*) or ( $sa1 and 1 of ($sb*) ) or (all of ($sc*) and $re1)
}
YARA Detection Rule: CVE_2014_4076_Exploitcode
Repository: Neo23x0/signature-base
Detects: Detects an exploit code for CVE-2014-4076
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/Neo23x0/yarGen

Pattern signatures:
$x1 = "[+] Created a new cmd.exe process" fullword ascii
      $x2 = "[+] Modified shellcode" fullword ascii
      $x3 = "[*] Spawning SYSTEM shell..." fullword ascii
      $x4 = "[*] MS14-070 (CVE-2014-4076) x86" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and 1 of them

Full rule:
rule CVE_2014_4076_Exploitcode {
   meta:
      description = "Detects an exploit code for CVE-2014-4076"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/Neo23x0/yarGen"
      date = "2018-04-04"
      hash1 = "44690af85efef2db04c7e8cba7ca0d0e53be1a1432a339570a7d26eec860b8ee"
      id = "83563dea-63d9-58a9-82ed[PII_REDACTED]71"
   strings:
      $x1 = "[+] Created a new cmd.exe process" fullword ascii
      $x2 = "[+] Modified shellcode" fullword ascii
      $x3 = "[*] Spawning SYSTEM shell..." fullword ascii
      $x4 = "[*] MS14-070 (CVE-2014-4076) x86" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 100KB and 1 of them
}
YARA Detection Rule: APT_PS1_SysAid_EXPL_ForensicArtifacts_Nov23_1
Repository: Neo23x0/signature-base
Detects: Detects forensic artifacts found in attacks on SysAid on-prem software exploiting CVE-2023-47246
Author: Florian Roth
Reference: https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification

Pattern signatures:
$x1 = "if ($s -match '^(Sophos).*\\.exe\\s') {echo $s; $bp++;}" ascii wide
      $x2 = "$s=$env:SehCore;$env:SehCore=\"\";Invoke-Expression $s;" ascii wide

Detection condition:
1 of them

Full rule:
rule APT_PS1_SysAid_EXPL_ForensicArtifacts_Nov23_1 : SCRIPT {
   meta:
      description = "Detects forensic artifacts found in attacks on SysAid on-prem software exploiting CVE-2023-47246"
      author = "Florian Roth"
      score = 85
      reference = "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification"
      date = "2023-11-09"
      id = "df7997d3-9309-58b3-8cd7-de9fea36d3c7"
   strings:
      $x1 = "if ($s -match '^(Sophos).*\\.exe\\s') {echo $s; $bp++;}" ascii wide
      $x2 = "$s=$env:SehCore;$env:SehCore=\"\";Invoke-Expression $s;" ascii wide
   condition:
      1 of them
}
YARA Detection Rule: MAL_Loader_TurtleLoader_Nov23
Repository: Neo23x0/signature-base
Detects: Detects Tutle loader used in attacks against SysAid CVE-2023-47246
Author: Florian Roth
Reference: https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification

Pattern signatures:
$s1 = "No key in args!" ascii fullword
      $s2 = "Bad data file!" ascii fullword
      $s3 = "Data file loaded. Running..." ascii

      $op1 = { 48 8d 55 c8 4c 8d 3d ac 8f 00 00 45 33 c9 45 33 d2 4d 8b e7 44 21 0a 45 33 db 4c 8d 3d 16 ec ff ff }
      $op2 = { 48 d3 e8 0f b6 c8 49 03 cb 49 81 c3 00 01 00 00 45 33 8c 8f a0 e4 00 00 41 83 fa 04 7c c7 41 ff c0 }
      $op3 = { 48 83 c1 04 48 ff ca 89 41 1c 75 ef 03 f6 48 83 c3 20 48 ff cd 0f 85 77 ff ff ff }

Detection condition:
uint16(0) == 0x5a4d
      and filesize < 200KB
      and 3 of them

Full rule:
rule MAL_Loader_TurtleLoader_Nov23 {
   meta:
      description = "Detects Tutle loader used in attacks against SysAid CVE-2023-47246"
      author = "Florian Roth"
      reference = "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification"
      date = "2023-11-09"
      score = 85
      hash1 = "b5acf14cdac40be590318dee95425d0746e85b1b7b1cbd14da66f21f2522bf4d"
      id = "c7b5d03d-52c4-59b4-ac69-55e532a21340"
   strings:
      $s1 = "No key in args!" ascii fullword
      $s2 = "Bad data file!" ascii fullword
      $s3 = "Data file loaded. Running..." ascii

      $op1 = { 48 8d 55 c8 4c 8d 3d ac 8f 00 00 45 33 c9 45 33 d2 4d 8b e7 44 21 0a 45 33 db 4c 8d 3d 16 ec ff ff }
      $op2 = { 48 d3 e8 0f b6 c8 49 03 cb 49 81 c3 00 01 00 00 45 33 8c 8f a0 e4 00 00 41 83 fa 04 7c c7 41 ff c0 }
      $op3 = { 48 83 c1 04 48 ff ca 89 41 1c 75 ef 03 f6 48 83 c3 20 48 ff cd 0f 85 77 ff ff ff }
   condition:
      uint16(0) == 0x5a4d
      and filesize < 200KB
      and 3 of them
}