deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EXPL_Keepass_CVE_2023_24055_Jan23
Repository: Neo23x0/signature-base
Detects: Detects suspicious entries in the Keepass configuration file, which could be indicator of the exploitation of CVE-2023-24055
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/alt3kx/CVE-2023-24055_PoC

Pattern signatures:
$a1 = "<TriggerCollection xmlns:xsi=" ascii wide

      $x1 = "<Parameter>KeePass XML (2.x)</Parameter>"
      $x2 = "::ReadAllBytes("
      $x3 = " -Method "
      $x4 = " bypass "
      $x5 = "powershell" nocase ascii wide fullword

Detection condition:
filesize < 200KB and $a1 and 1 of ($x*)

Full rule:
rule EXPL_Keepass_CVE_2023_24055_Jan23 {
   meta:
      description = "Detects suspicious entries in the Keepass configuration file, which could be indicator of the exploitation of CVE-2023-24055"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/alt3kx/CVE-2023-24055_PoC"
      date = "2023-01-25"
      score = 75
      id = "2c031919-da19-5fd0-b21a-2e83679ad1e3"
   strings:
      $a1 = "<TriggerCollection xmlns:xsi=" ascii wide

      $x1 = "<Parameter>KeePass XML (2.x)</Parameter>"
      $x2 = "::ReadAllBytes("
      $x3 = " -Method "
      $x4 = " bypass "
      $x5 = "powershell" nocase ascii wide fullword
   condition:
      filesize < 200KB and $a1 and 1 of ($x*)
}
YARA Detection Rule: SUSP_Keepass_CVE_2023_24055_Jan23
Repository: Neo23x0/signature-base
Detects: Detects suspicious triggers defined in the Keepass configuration file, which could be indicator of the exploitation of CVE-2023-24055
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/alt3kx/CVE-2023-24055_PoC

Pattern signatures:
$a1 = "<TriggerCollection xmlns:xsi=" ascii wide

      $s1 = "<Action>" ascii wide
      $s2 = "<Parameter>" ascii wide

Detection condition:
filesize < 200KB and $a1 and all of ($s*)

Full rule:
rule SUSP_Keepass_CVE_2023_24055_Jan23 {
   meta:
      description = "Detects suspicious triggers defined in the Keepass configuration file, which could be indicator of the exploitation of CVE-2023-24055"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/alt3kx/CVE-2023-24055_PoC"
      date = "2023-01-25"
      score = 60
      id = "4ff1a93f-f7f0-528d-9e07-402e321a0ffe"
   strings:
      $a1 = "<TriggerCollection xmlns:xsi=" ascii wide

      $s1 = "<Action>" ascii wide
      $s2 = "<Parameter>" ascii wide
   condition:
      filesize < 200KB and $a1 and all of ($s*)
}
YARA Detection Rule: HttpBrowser_RAT_Sample1
Repository: Neo23x0/signature-base
Detects: Threat Group 3390 APT Sample - HttpBrowser RAT Sample update.hancominc.com
Author: Florian Roth (Nextron Systems)
Reference: http://snip.ly/giNB

Pattern signatures:
$s0 = "update.hancominc.com" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and $s0

Full rule:
rule HttpBrowser_RAT_Sample1 {
	meta:
		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Sample update.hancominc.com"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://snip.ly/giNB"
		date = "2015-08-06"
		score = 80
		hash1 = "be334d1f8fa65a723af65200a166c2bbdb06690c8b30fafe772600e4662fc68b"
		hash2 = "1052ad7f4d49542e4da07fa8ea59c15c40bc09a4d726fad023daafdf05866ebb"
		id = "8babf47f-006c-5001-9753-08ac08f5e861"
	strings:
		$s0 = "update.hancominc.com" fullword wide 
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and $s0
}
YARA Detection Rule: HttpBrowser_RAT_Sample2
Repository: Neo23x0/signature-base
Detects: Threat Group 3390 APT Sample - HttpBrowser RAT Sample
Author: Florian Roth (Nextron Systems)
Reference: http://snip.ly/giNB

Pattern signatures:
$s0 = "nKERNEL32.DLL" fullword wide
		$s1 = "WUSER32.DLL" fullword wide
		$s2 = "mscoree.dll" fullword wide
		$s3 = "VPDN_LU.exeUT" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 250KB and all of them

Full rule:
rule HttpBrowser_RAT_Sample2 {
	meta:
		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://snip.ly/giNB"
		date = "2015-08-06"
		score = 80
		hash1 = "c57c5a2c322af2835ae136b75283eaaeeaa6aa[PII_REDACTED]82a9983ae47b8992"
		id = "693d381f-50b0-5f06-b725-78243b67092c"
	strings:
		$s0 = "nKERNEL32.DLL" fullword wide
		$s1 = "WUSER32.DLL" fullword wide
		$s2 = "mscoree.dll" fullword wide
		$s3 = "VPDN_LU.exeUT" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 250KB and all of them
}
YARA Detection Rule: HttpBrowser_RAT_Gen
Repository: Neo23x0/signature-base
Detects: Threat Group 3390 APT Sample - HttpBrowser RAT Generic
Author: Florian Roth (Nextron Systems)
Reference: http://snip.ly/giNB

Pattern signatures:
$s0 = "%d|%s|%04d/%02d/%02d %02d:%02d:%02d|%ld|%d" fullword wide 
		$s1 = "HttpBrowser/1.0" fullword wide
		$s2 = "set cmd : %s" ascii fullword
		$s3 = "\\config.ini" wide fullword

Detection condition:
uint16(0) == 0x5a4d and filesize < 45KB and filesize > 20KB and all of them

Full rule:
rule HttpBrowser_RAT_Gen {
	meta:
		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Generic"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://snip.ly/giNB"
		date = "2015-08-06"
		score = 90
		hash1 = "0299493ccb175d452866f5e21d023d3e92cd8d28452517d1d19c0f05f2c5ca27"
		hash2 = "065d055a90da59b4bdc88b97e537d6489602cb5dc894c5c16aff94d05c09abc7"
		hash3 = "05c7291db880f94c675eea336ecd66338bd0b1d49ad239cc17f9df08106e6684"
		hash4 = "07133f291fe022cd14346cd1f0a649aa2704ec9ccadfab809ca9c48b91a7d81b"
		hash5 = "0f8893e87ddec3d98e39a57f7cd530c28e36d596ea0a1d9d1e993dc2cae0a64d"
		hash6 = "108e6633744da6efe773eb78bd0ac804920add81c3dde4b26e953056ac1b26c5"
		hash7 = "1052ad7f4d49542e4da07fa8ea59c15c40bc09a4d726fad023daafdf05866ebb"
		hash8 = "1277ede988438d4168bb5b135135dd3b9ae7d9badcdf1421132ca4692dd18386"
		hash9 = "19be90c152f7a174835fd05a0b6f722e29c648969579ed7587ae036679e66a7b"
		hash10 = "1e7133bf5a9fe5e462321aafc2b7770b8e4183a66c7fef14364a0c3f698a29af"
		hash11 = "2264e5e8fcbdcb29027798b200939ecd8d1d3ad1ef0aef2b8ce7687103a3c113"
		hash12 = "2a1bdeb0a021fb0bdbb328bd4b65167d1f954c871fc33359cb5ea472bad6e13e"
		hash13 = "259a2e0508832d0cf3f4f5d9e9e1adde17102d2804541a9587a9a4b6f6f86669"
		hash14 = "240d9ce148091e72d8f501dbfbc7963997d5c2e881b4da59a62975ddcbb77ca2"
		hash15 = "211a1b195cf2cc70a2caf8f1aafb8426eb0e4bae955e85266490b12b5322aa16"
		hash16 = "2d25c6868c16085c77c58829d538b8f3dbec67485f79a059f24e0dce1e804438"
		hash17 = "2d932d764dd9b91166361d8c023d64a4480b5b587a6087b0ce3d2ac92ead8a7d"
		hash18 = "3556722d9aa37beadfa6ba248a66576f767e04b09b239d3fb0479fa93e0ba3fd"
		hash19 = "365e1d4180e93d7b87ba28ce4369312cbae191151ac23ff4a35f45440cb9be48"
		hash20 = "36c49f18ce3c205152eef82887eb3070e9b111d35a42b534b2fb2ee535b543c0"
		hash21 = "3eeb1fd1f0d8ab33f34183893c7346ddbbf3c19b94ba3602d377fa2e84aaad81"
		hash22 = "3fa8d13b337671323e7fe8b882763ec29b
YARA Detection Rule: PlugX_NvSmartMax_Gen
Repository: Neo23x0/signature-base
Detects: Threat Group 3390 APT Sample - PlugX NvSmartMax Generic
Author: Florian Roth (Nextron Systems)
Reference: http://snip.ly/giNB

Pattern signatures:
$s0 = "NvSmartMax.dll" fullword ascii
		$s1 = "NvSmartMax.dll.url" fullword ascii
		$s2 = "Nv.exe" fullword ascii
		$s4 = "CryptProtectMemory failed" fullword ascii 
		$s5 = "CryptUnprotectMemory failed" fullword ascii 
		$s7 = "r%.*s(%d)%s" fullword wide
		$s8 = " %s CRC " fullword wide

		$op0 = { c6 05 26 49 42 00 01 eb 4a 8d 85 00 f8 ff ff 50 } /* Opcode */
		$op1 = { 8d 85 c8 fe ff ff 50 8d 45 c8 50 c6 45 47 00 e8 } /* Opcode */
		$op2 = { e8 e6 65 00 00 50 68 10 43 41 00 e8 56 84 00 00 } /* Opcode */

Detection condition:
uint16(0) == 0x5a4d and filesize < 800KB and all of ($s*) and 1 of ($op*)

Full rule:
rule PlugX_NvSmartMax_Gen {
	meta:
		description = "Threat Group 3390 APT Sample - PlugX NvSmartMax Generic"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://snip.ly/giNB"
		date = "2015-08-06"
		score = 70
		hash1 = "718fc72942b9b706488575c[PII_REDACTED]170463f6f40fa19b08fc84b79bf0cef"
		hash2 = "1c0379481d17fc80b3330f148f1b87ff613cfd2a6601d97920a0bcd808c718d0"
		hash3 = "555952aa5bcca4fa5ad5a7269fece99b1a04816d104ecd8aefabaa1435f65fa5"
		hash4 = "71f7a9da99b5e3c9520bc2cc73e520598d469be6539b3c243fb435fe02e44338"
		hash5 = "65bbf0bd8c6e1ccdb60cf646d7084e1452cb111d97d21d6e8117b1944f3dc71e"
		id = "5ecd25a8-9717-527f-bb6e-3259b9a60458"
	strings:
		$s0 = "NvSmartMax.dll" fullword ascii
		$s1 = "NvSmartMax.dll.url" fullword ascii
		$s2 = "Nv.exe" fullword ascii
		$s4 = "CryptProtectMemory failed" fullword ascii 
		$s5 = "CryptUnprotectMemory failed" fullword ascii 
		$s7 = "r%.*s(%d)%s" fullword wide
		$s8 = " %s CRC " fullword wide

		$op0 = { c6 05 26 49 42 00 01 eb 4a 8d 85 00 f8 ff ff 50 } /* Opcode */
		$op1 = { 8d 85 c8 fe ff ff 50 8d 45 c8 50 c6 45 47 00 e8 } /* Opcode */
		$op2 = { e8 e6 65 00 00 50 68 10 43 41 00 e8 56 84 00 00 } /* Opcode */
	condition:
		uint16(0) == 0x5a4d and filesize < 800KB and all of ($s*) and 1 of ($op*)
}
YARA Detection Rule: HttpBrowser_RAT_dropper_Gen2
Repository: Neo23x0/signature-base
Detects: Threat Group 3390 APT Sample - HttpBrowser RAT Dropper
Author: Florian Roth (Nextron Systems)
Reference: http://snip.ly/giNB

Pattern signatures:
$s1 = "navlu.dll.urlUT" fullword ascii
		$s2 = "VPDN_LU.exeUT" fullword ascii
		$s3 = "pnipcn.dllUT" fullword ascii
		$s4 = "\\ssonsvr.exe" ascii
		$s5 = "/c del /q %s" fullword ascii
		$s6 = "\\setup.exe" ascii 
		$s7 = "msi.dllUT" fullword ascii

		$op0 = { 8b 45 0c 83 38 00 0f 84 98 } /* Opcode */
		$op1 = { e8 dd 07 00 00 ff 35 d8 fb 40 00 8b 35 7c a0 40 } /* Opcode */
		$op2 = { 83 fb 08 75 2c 8b 0d f8 af 40 00 89 4d dc 8b 0d } /* Opcode */
		$op3 = { c7 43 18 8c 69 40 00 e9 da 01 00 00 83 7d f0 00 } /* Opcode */
		$op4 = { 6a 01 e9 7c f8 ff ff bf 1a 40 00 96 1b 40 00 01 } /* Opcode */

Detection condition:
uint16(0) == 0x5a4d and filesize < 400KB and 3 of ($s*) and 1 of ($op*)

Full rule:
rule HttpBrowser_RAT_dropper_Gen2 {
	meta:
		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Dropper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://snip.ly/giNB"
		date = "2015-08-06"
		score = 70
		hash1 = "c57c5a2c322af2835ae136b75283eaaeeaa6aa[PII_REDACTED]82a9983ae47b8992"
		hash2 = "dfa984174268a9f364d856fd47cfaca75804640f849624d69d81fcaca2b57166"
		id = "cd559642-a102-5946-8a7f-16c10e7f746d"
	strings:
		$s1 = "navlu.dll.urlUT" fullword ascii
		$s2 = "VPDN_LU.exeUT" fullword ascii
		$s3 = "pnipcn.dllUT" fullword ascii
		$s4 = "\\ssonsvr.exe" ascii
		$s5 = "/c del /q %s" fullword ascii
		$s6 = "\\setup.exe" ascii 
		$s7 = "msi.dllUT" fullword ascii

		$op0 = { 8b 45 0c 83 38 00 0f 84 98 } /* Opcode */
		$op1 = { e8 dd 07 00 00 ff 35 d8 fb 40 00 8b 35 7c a0 40 } /* Opcode */
		$op2 = { 83 fb 08 75 2c 8b 0d f8 af 40 00 89 4d dc 8b 0d } /* Opcode */
		$op3 = { c7 43 18 8c 69 40 00 e9 da 01 00 00 83 7d f0 00 } /* Opcode */
		$op4 = { 6a 01 e9 7c f8 ff ff bf 1a 40 00 96 1b 40 00 01 } /* Opcode */
	condition:
		uint16(0) == 0x5a4d and filesize < 400KB and 3 of ($s*) and 1 of ($op*)
}
YARA Detection Rule: ThreatGroup3390_Strings
Repository: Neo23x0/signature-base
Detects: Threat Group 3390 APT - Strings
Author: Florian Roth (Nextron Systems)
Reference: http://snip.ly/giNB

Pattern signatures:
$s1 = "\"cmd\" /c cd /d \"c:\\Windows\\Temp\\\"&copy" ascii
		$s2 = "svchost.exe a -k -r -s -m5 -v1024000 -padmin-windows2014"
		$s3 = "ren *.rar *.zip" fullword ascii
		$s4 = "c:\\temp\\ipcan.exe" fullword ascii
		$s5 = "<%eval(Request.Item(\"admin-na-google123!@#" ascii

Detection condition:
1 of them and filesize < 30KB

Full rule:
rule ThreatGroup3390_Strings {
	meta:
		description = "Threat Group 3390 APT - Strings"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://snip.ly/giNB"
		date = "2015-08-06"
		score = 60
		id = "9a44393b-5220-5376-ba18-2330f4623cd6"
	strings:
		$s1 = "\"cmd\" /c cd /d \"c:\\Windows\\Temp\\\"&copy" ascii
		$s2 = "svchost.exe a -k -r -s -m5 -v1024000 -padmin-windows2014"
		$s3 = "ren *.rar *.zip" fullword ascii
		$s4 = "c:\\temp\\ipcan.exe" fullword ascii
		$s5 = "<%eval(Request.Item(\"admin-na-google123!@#" ascii
	condition:
		1 of them and filesize < 30KB
}
YARA Detection Rule: MAL_Go_Modbus_Jul24_1
Repository: Neo23x0/signature-base
Detects: Detects characteristics reported by Dragos for FrostyGoop ICS malware
Author: Florian Roth
Reference: https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_.pdf

Pattern signatures:
$a1 = "Go build"

      $sa1 = "github.com/rolfl/modbus"

      $sb1 = "main.TaskList.executeCommand"
      $sb2 = "main.TargetList.getTargetIpList"
      $sb3 = "main.TaskList.getTaskIpList"
      $sb4 = "main.CycleInfo" fullword

Detection condition:
filesize < 30MB
      and (
         $sa1
         and 3 of ($sb*)
      )
      or 4 of them

Full rule:
rule MAL_Go_Modbus_Jul24_1 {
   meta:
      description = "Detects characteristics reported by Dragos for FrostyGoop ICS malware"
      author = "Florian Roth"
      reference = "https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_.pdf"
      date = "2024-07-23"
      modified = "2024-07-24"
      score = 75
      hash1 = "5d2e4fd08f81e3b2eb2f3eaae16eb32ae02e760afc36fa17f4649322f6da53fb"
      id = "4a1e6bbe-d743-5394-b207-e417b64fa76d"
   strings:
      $a1 = "Go build"

      $sa1 = "github.com/rolfl/modbus"

      $sb1 = "main.TaskList.executeCommand"
      $sb2 = "main.TargetList.getTargetIpList"
      $sb3 = "main.TaskList.getTaskIpList"
      $sb4 = "main.CycleInfo" fullword
   condition:
      filesize < 30MB
      and (
         $sa1
         and 3 of ($sb*)
      )
      or 4 of them
}
YARA Detection Rule: ATM_Malware_XFSADM
Repository: Neo23x0/signature-base
Detects: Detects ATM Malware XFSADM
Author: Frank Boldewin (@r3c0nst), modified by Florian Roth
Reference: https://twitter.com/r3c0nst/status/[PII_REDACTED]44308992

Pattern signatures:
$Code1 = {68 88 13 00 00 FF 35 ?? ?? ?? ?? 68 CF 00 00 00 50 FF 15} // Read Card Data
      $Code2 = {68 98 01 00 00 50 FF 15} // Get PIN Data
      $Mutex = "myXFSADM" wide
      $MSXFSDIR = "C:\\Windows\\System32\\msxfs.dll" ascii
      $XFSCommand1 = "WfsExecute" ascii
      $XFSCommand2 = "WfsGetInfo" ascii
      $PDB = "C:\\Work64\\ADM\\XFS\\Release\\XFS.pdb" ascii
      $WindowName = "XFS ADM" wide
      $FindWindow = "ADM rec" wide
      $LogFile = "xfs.log" ascii
      $TmpFile = "~pipe.tmp" ascii

Detection condition:
uint16(0) == 0x5A4D and filesize < 500KB and ( 4 of them or $PDB )

Full rule:
rule ATM_Malware_XFSADM {
   meta:
      description = "Detects ATM Malware XFSADM"
      author = "Frank Boldewin (@r3c0nst), modified by Florian Roth"
      reference = "https://twitter.com/r3c0nst/status/[PII_REDACTED]44308992"
      date = "2019-06-21"
      hash1 = "2740bd2b7aa0eaa8de2135dd710eb669d4c4c91d29eefbf54f1b81165ad2da4d"
      id = "7bd7e194-1cf1-5d12-809b-25aaf7f62ca3"
   strings:
      $Code1 = {68 88 13 00 00 FF 35 ?? ?? ?? ?? 68 CF 00 00 00 50 FF 15} // Read Card Data
      $Code2 = {68 98 01 00 00 50 FF 15} // Get PIN Data
      $Mutex = "myXFSADM" wide
      $MSXFSDIR = "C:\\Windows\\System32\\msxfs.dll" ascii
      $XFSCommand1 = "WfsExecute" ascii
      $XFSCommand2 = "WfsGetInfo" ascii
      $PDB = "C:\\Work64\\ADM\\XFS\\Release\\XFS.pdb" ascii
      $WindowName = "XFS ADM" wide
      $FindWindow = "ADM rec" wide
      $LogFile = "xfs.log" ascii
      $TmpFile = "~pipe.tmp" ascii
   condition:
      uint16(0) == 0x5A4D and filesize < 500KB and ( 4 of them or $PDB )
}
YARA Detection Rule: FVEY_ShadowBrokers_Jan17_Screen_Strings
Repository: Neo23x0/signature-base
Detects: Detects strings derived from the ShadowBroker's leak of Windows tools/exploits
Author: Florian Roth (Nextron Systems)
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message7/

Pattern signatures:
$x1 = "Danderspritz" ascii wide fullword
      $x2 = "DanderSpritz" ascii wide fullword
      $x3 = "PeddleCheap" ascii wide fullword
      $x4 = "ChimneyPool Addres" ascii wide fullword

      $a1 = "Getting remote time" fullword ascii
      $a2 = "RETRIEVED" fullword ascii

      $b1 = "Added Ops library to Python search path" fullword ascii
      $b2 = "target: z0.0.0.1" fullword ascii

      $c1 = "Psp_Avoidance" fullword ascii
      $c2 = "PasswordDump" fullword ascii
      $c4 = "EventLogEdit" fullword ascii

      $d1 = "Mcl_NtElevation" fullword ascii wide
      $d2 = "Mcl_NtNativeApi" fullword ascii wide
      $d3 = "Mcl_ThreatInject" fullword ascii wide
      $d4 = "Mcl_NtMemory" fullword ascii wide

Detection condition:
filesize < 2000KB and (
        1 of ($x*) or
        all of ($a*) or
        1 of ($b*) or
        ( uint16(0) == 0x5a4d and 1 of ($c*) ) or
        3 of ($c*) or
        ( uint16(0) == 0x5a4d and 3 of ($d*) )
      )

Full rule:
rule FVEY_ShadowBrokers_Jan17_Screen_Strings {
   meta:
      description = "Detects strings derived from the ShadowBroker's leak of Windows tools/exploits"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message7/"
      date = "2017-01-08"
      id = "59832d0a-0cb2-5eb9-a4e2-36aaa09a3998"
   strings:
      $x1 = "Danderspritz" ascii wide fullword
      $x2 = "DanderSpritz" ascii wide fullword
      $x3 = "PeddleCheap" ascii wide fullword
      $x4 = "ChimneyPool Addres" ascii wide fullword

      $a1 = "Getting remote time" fullword ascii
      $a2 = "RETRIEVED" fullword ascii

      $b1 = "Added Ops library to Python search path" fullword ascii
      $b2 = "target: z0.0.0.1" fullword ascii

      $c1 = "Psp_Avoidance" fullword ascii
      $c2 = "PasswordDump" fullword ascii
      $c4 = "EventLogEdit" fullword ascii

      $d1 = "Mcl_NtElevation" fullword ascii wide
      $d2 = "Mcl_NtNativeApi" fullword ascii wide
      $d3 = "Mcl_ThreatInject" fullword ascii wide
      $d4 = "Mcl_NtMemory" fullword ascii wide
   condition:
      filesize < 2000KB and (
        1 of ($x*) or
        all of ($a*) or
        1 of ($b*) or
        ( uint16(0) == 0x5a4d and 1 of ($c*) ) or
        3 of ($c*) or
        ( uint16(0) == 0x5a4d and 3 of ($d*) )
      )
}
YARA Detection Rule: EXP_Libre_Office_CVE_2018_16858
Repository: Neo23x0/signature-base
Detects: RCE in Libre Office with crafted ODT file (CVE-2018-16858)
Author: John Lambert @JohnLaTwC / modified by Florian Roth
Reference: https://insert-script.blogspot.com/2019/02/libreoffice-cve-2018-16858-remote-code.html

Pattern signatures:
$s1 = "xlink:href=\"vnd.sun.star.script:" ascii nocase
        $s2 = ".py$tempfilepager" ascii nocase
        $tag = {3c 6f 66 66 69 63 65 3a 64 6f 63 }

Detection condition:
uint32be(0) == 0x3c3f786d // <?xm
        and $tag in (0..0100) // <office:doc
        and all of ($s*)

Full rule:
rule EXP_Libre_Office_CVE_2018_16858 {
    meta:
        description = "RCE in Libre Office with crafted ODT file (CVE-2018-16858)"
        author = "John Lambert @JohnLaTwC / modified by Florian Roth"
        date = "2019-02-01"
        reference = "https://insert-script.blogspot.com/2019/02/libreoffice-cve-2018-16858-remote-code.html"
        hash = "95a02b70c117947ff989e3e00868c2185142df9be751a3fefe21f18fa16a1a6f"
        id = "17a0a569-27bf-57ab-937e-8943442ae604"
    strings:
        $s1 = "xlink:href=\"vnd.sun.star.script:" ascii nocase
        $s2 = ".py$tempfilepager" ascii nocase
        $tag = {3c 6f 66 66 69 63 65 3a 64 6f 63 }
    condition:
        uint32be(0) == 0x3c3f786d // <?xm
        and $tag in (0..0100) // <office:doc
        and all of ($s*)
}
YARA Detection Rule: SUSP_Microsoft_7z_SFX_Combo
Repository: Neo23x0/signature-base
Detects: Detects a suspicious file that has a Microsoft copyright and is a 7z SFX
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "7ZSfx%03x.cmd" fullword wide
      $s2 = "7z SFX: error" fullword ascii

      /* PE Header : LegalCopyright (C) Microsoft Corporation. All rights reserved.*/
      $c1 = { 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70
              00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 A9
              00 20 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F
              00 66 00 74 00 20 00 43 00 6F 00 72 00 70 00 6F
              00 72 00 61 00 74 00 69 00 6F 00 6E 00 2E 00 20
              00 41 00 6C 00 6C 00 20 00 72 00 69 00 67 00 68
              00 74 00 73 00 20 00 72 00 65 00 73 00 65 00 72
              00 76 00 65 00 64 00 2E }

Detection condition:
uint16(0) == 0x5a4d and filesize < 3000KB and 1 of ($s*) and $c1

Full rule:
rule SUSP_Microsoft_7z_SFX_Combo {
   meta:
      description = "Detects a suspicious file that has a Microsoft copyright and is a 7z SFX"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2018-09-16"
      hash1 = "cce63f209ee4efb4f0419fb4bbb32326392b5ef85cfba80b5b42b861637f1ff1"
      id = "9163a689-c3ee-59b1-bf58-aef5d3072be6"
   strings:
      $s1 = "7ZSfx%03x.cmd" fullword wide
      $s2 = "7z SFX: error" fullword ascii

      /* PE Header : LegalCopyright (C) Microsoft Corporation. All rights reserved.*/
      $c1 = { 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70
              00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 A9
              00 20 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F
              00 66 00 74 00 20 00 43 00 6F 00 72 00 70 00 6F
              00 72 00 61 00 74 00 69 00 6F 00 6E 00 2E 00 20
              00 41 00 6C 00 6C 00 20 00 72 00 69 00 67 00 68
              00 74 00 73 00 20 00 72 00 65 00 73 00 65 00 72
              00 76 00 65 00 64 00 2E }
   condition:
      uint16(0) == 0x5a4d and filesize < 3000KB and 1 of ($s*) and $c1
}