deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: HKTL_Solarwinds_credential_stealer
Repository: Neo23x0/signature-base
Detects: Detects solarwinds credential stealers like e.g. solarflare via the touched certificate, files and database columns
Author: Arnim Rupp
Reference: https://github.com/mubix/solarflare

Pattern signatures:
$certificate = "CN=SolarWinds-Orion" ascii nocase wide
        $credfile1 = "\\CredentialStorage\\SolarWindsDatabaseAccessCredential" ascii nocase wide
        $credfile2 = "\\KeyStorage\\CryptoHelper\\default.dat" ascii nocase wide
        $credfile3 = "\\Orion\\SWNetPerfMon.DB" ascii nocase wide
        $credfile4 = "\\Orion\\RabbitMQ\\.erlang.cookie" ascii nocase wide
        $sql1 = "encryptedkey" ascii nocase wide fullword
        $sql2 = "protectiontype" ascii nocase wide fullword
        $sql3 = "CredentialProperty" ascii nocase wide fullword
        $sql4 = "passwordhash" ascii nocase wide fullword
        $sql5 = "credentialtype" ascii nocase wide fullword
        $sql6 = "passwordsalt" ascii nocase wide fullword

Detection condition:
uint16(0) == 0x5A4D and $certificate and ( 2 of ( $credfile* ) or 5 of ( $sql* ) )

Full rule:
rule HKTL_Solarwinds_credential_stealer {
    meta:
        description = "Detects solarwinds credential stealers like e.g. solarflare via the touched certificate, files and database columns"
        reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware"
        reference = "https://github.com/mubix/solarflare"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-20"
		hash = "1b2e5186464ed0bdd38fcd9f4ab294a7ba28bd829bf296584cbc32e2889037e4"
		hash = "4adb69d4222c80d97f8d64e4d48b574908a518f8d504f24ce93a18b90bd506dc"
        id = "87dba889-367a-5fc3-b5e0-eb8e3c36a5e9"
    strings:
        $certificate = "CN=SolarWinds-Orion" ascii nocase wide
        $credfile1 = "\\CredentialStorage\\SolarWindsDatabaseAccessCredential" ascii nocase wide
        $credfile2 = "\\KeyStorage\\CryptoHelper\\default.dat" ascii nocase wide
        $credfile3 = "\\Orion\\SWNetPerfMon.DB" ascii nocase wide
        $credfile4 = "\\Orion\\RabbitMQ\\.erlang.cookie" ascii nocase wide
        $sql1 = "encryptedkey" ascii nocase wide fullword
        $sql2 = "protectiontype" ascii nocase wide fullword
        $sql3 = "CredentialProperty" ascii nocase wide fullword
        $sql4 = "passwordhash" ascii nocase wide fullword
        $sql5 = "credentialtype" ascii nocase wide fullword
        $sql6 = "passwordsalt" ascii nocase wide fullword
    condition:
        uint16(0) == 0x5A4D and $certificate and ( 2 of ( $credfile* ) or 5 of ( $sql* ) )
}
YARA Detection Rule: ScanBox_Malware_Generic
Repository: Neo23x0/signature-base
Detects: Scanbox Chinese Deep Panda APT Malware http://goo.gl/MUUfjv and http://goo.gl/WXUQcP
Author: Florian Roth (Nextron Systems)

Pattern signatures:
/* Sample 1 */
		$s0 = "http://142.91.76.134/p.dat" fullword ascii
		$s1 = "HttpDump 1.1" fullword ascii

		/* Sample 2 */
		$s3 = "SecureInput .exe" fullword wide
		$s4 = "http://extcitrix.we11point.com/vpn/index.php?ref=1" fullword ascii

		/* Sample 3 */
		$s5 = "%SystemRoot%\\System32\\svchost.exe -k msupdate" fullword ascii
		$s6 = "ServiceMaix" fullword ascii

		/* Certificate and Keywords */
		$x1 = "Management Support Team1" fullword ascii
		$x2 = "DTOPTOOLZ Co.,Ltd.0" fullword ascii
		$x3 = "SEOUL1" fullword ascii

Detection condition:
( 1 of ($s*) and 2 of ($x*) ) or
		( 3 of ($x*) )

Full rule:
rule ScanBox_Malware_Generic {
	meta:
		description = "Scanbox Chinese Deep Panda APT Malware http://goo.gl/MUUfjv and http://goo.gl/WXUQcP"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference1 = "http://goo.gl/MUUfjv"
		reference2 = "http://goo.gl/WXUQcP"
		date = "2015/02/28"
		hash1 = "8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9"
		hash2 = "d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d"
		hash3 = "3fe208273288fc4d8db1bf20078d550e321d9bc5b9ab80c93d79d2cb05cbf8c2"
		id = "f7867e65-567f-530f-83d4-b5126021e523"
	strings:
		/* Sample 1 */
		$s0 = "http://142.91.76.134/p.dat" fullword ascii
		$s1 = "HttpDump 1.1" fullword ascii

		/* Sample 2 */
		$s3 = "SecureInput .exe" fullword wide
		$s4 = "http://extcitrix.we11point.com/vpn/index.php?ref=1" fullword ascii

		/* Sample 3 */
		$s5 = "%SystemRoot%\\System32\\svchost.exe -k msupdate" fullword ascii
		$s6 = "ServiceMaix" fullword ascii

		/* Certificate and Keywords */
		$x1 = "Management Support Team1" fullword ascii
		$x2 = "DTOPTOOLZ Co.,Ltd.0" fullword ascii
		$x3 = "SEOUL1" fullword ascii
	condition:
		( 1 of ($s*) and 2 of ($x*) ) or
		( 3 of ($x*) )
}
YARA Detection Rule: Sofacy_Jun16_Sample1
Repository: Neo23x0/signature-base
Detects: Detects Sofacy Malware mentioned in PaloAltoNetworks APT report
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/mzAa97

Pattern signatures:
$s1 = "clconfg.dll" fullword ascii
		$s2 = "ASijnoKGszdpodPPiaoaghj8127391" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($s*) ) ) or ( all of them )

Full rule:
rule Sofacy_Jun16_Sample1 {
	meta:
		description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/mzAa97"
		date = "2016-06-14"
		score = 85
		hash1 = "be1cfa10fcf2668ae01b98579b345ebe87dab77b6b1581c368d1aba9fd2f10a0"
		id = "62b577e3-7ccb-59df-a944-96ffe9b16d3d"
	strings:
		$s1 = "clconfg.dll" fullword ascii
		$s2 = "ASijnoKGszdpodPPiaoaghj8127391" fullword wide
	condition:
		( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($s*) ) ) or ( all of them )
}
YARA Detection Rule: Sofacy_Jun16_Sample2
Repository: Neo23x0/signature-base
Detects: Detects Sofacy Malware mentioned in PaloAltoNetworks APT report
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/mzAa97

Pattern signatures:
$x1 = "DGMNOEP" fullword ascii
		$x2 = "/%s%s%s/?%s=" fullword ascii

		$s1 = "Control Panel\\Dehttps=https://%snetwork.proxy.ht2" fullword ascii
		$s2 = "http=http://%s:%Control Panel\\Denetwork.proxy.ht&ol1mS9" fullword ascii
		$s3 = "svchost.dll" fullword wide
		$s4 = "clconfig.dll" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and ( all of ($x*) ) ) or ( 3 of them )

Full rule:
rule Sofacy_Jun16_Sample2 {
	meta:
		description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/mzAa97"
		date = "2016-06-14"
		score = 85
		hash1 = "57d230ddaf92e2d0504e5bb12abf52062114fb8980c5ecc413116b1d6ffedf1b"
		hash2 = "69940a20ab9abb31a03fcefe6de92a16ed474bbdff[PII_REDACTED]afc12a834261"
		hash3 = "aeeab3272a2ed2157ebf67f74c00fafc787a2b9bbaa17a03be1e23d4cb273632"
		id = "21561e13-a190-565e-a08b-e6a07c84c3db"
	strings:
		$x1 = "DGMNOEP" fullword ascii
		$x2 = "/%s%s%s/?%s=" fullword ascii

		$s1 = "Control Panel\\Dehttps=https://%snetwork.proxy.ht2" fullword ascii
		$s2 = "http=http://%s:%Control Panel\\Denetwork.proxy.ht&ol1mS9" fullword ascii
		$s3 = "svchost.dll" fullword wide
		$s4 = "clconfig.dll" fullword wide
	condition:
		( uint16(0) == 0x5a4d and filesize < 100KB and ( all of ($x*) ) ) or ( 3 of them )
}
YARA Detection Rule: Sofacy_Jun16_Sample3
Repository: Neo23x0/signature-base
Detects: Detects Sofacy Malware mentioned in PaloAltoNetworks APT report
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/mzAa97

Pattern signatures:
$s1 = "ASLIiasiuqpssuqkl713h" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and $s1

Full rule:
rule Sofacy_Jun16_Sample3 {
	meta:
		description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/mzAa97"
		date = "2016-06-14"
		score = 85
		hash1 = "c2551c4e6521ac72982cb952503a2e6f016356e02ee31dea36c713141d4f3785"
		id = "f97bc840-0d9a-5a9e-9e13-7b7f8acc53a5"
	strings:
		$s1 = "ASLIiasiuqpssuqkl713h" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and $s1
}
YARA Detection Rule: APT_APT28_Cannon_Trojan_Nov18_1
Repository: Neo23x0/signature-base
Detects: Detects Cannon Trojan used by Sofacy
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/

Pattern signatures:
$xc1 = { 46 6F 72 6D 31 00 63 61 6E 6E 6F 6E 00 4D 44 61
               74 00 41 55 54 48 }
      $xc2 = { 13 4F 00 53 00 3A 00 20 00 20 00 7B 00 30 00 7D
               00 0A 00 00 17 53 00 44 00 69 00 72 00 3A 00 20
               00 20 00 7B 00 30 00 7D 00 0A 00 00 1B 44 00 6F
               00 6D 00 61 00 69 00 6E 00 3A 00 20 00 20 00 7B
               00 30 00 7D 00 0A 00 00 15 48 00 6F 00 73 00 74
               00 3A 00 20 00 7B 00 30 00 7D 00 0A 00 00 21 43
               00 75 00 72 00 72 00 65 00 6E 00 74 00 55 00 73
               00 72 00 3A 00 20 00 7B 00 30 00 7D 00 0A 00 00
               17 54 00 69 00 6D 00 65 00 5A 00 3A 00 20 00 7B
               00 30 00 7D }
      $x2 = "\\Desktop\\cannon\\obj\\" ascii
      $x3 = "C:\\Users\\Public\\Music\\s.txt" fullword wide

      $s1 = "C:\\Documents and Settings\\All Users\\Documents" fullword wide
      $s2 = "notEncoded - Value here is never used" fullword wide
      $s3 = "Windows NT\\CurrentVersion\\Winlogon\"" fullword w

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and 1 of ($x*) or 3 of them

Full rule:
rule APT_APT28_Cannon_Trojan_Nov18_1 {
   meta:
      description = "Detects Cannon Trojan used by Sofacy"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"
      date = "2018-11-20"
      hash1 = "61a1f3b4fb4dbd2877c91e81db4b1af8395547eab199bf920e9dd11a1127221e"
      id = "a60f3e75-8bfe-592e-90d1-321bd86173ac"
   strings:
      $xc1 = { 46 6F 72 6D 31 00 63 61 6E 6E 6F 6E 00 4D 44 61
               74 00 41 55 54 48 }
      $xc2 = { 13 4F 00 53 00 3A 00 20 00 20 00 7B 00 30 00 7D
               00 0A 00 00 17 53 00 44 00 69 00 72 00 3A 00 20
               00 20 00 7B 00 30 00 7D 00 0A 00 00 1B 44 00 6F
               00 6D 00 61 00 69 00 6E 00 3A 00 20 00 20 00 7B
               00 30 00 7D 00 0A 00 00 15 48 00 6F 00 73 00 74
               00 3A 00 20 00 7B 00 30 00 7D 00 0A 00 00 21 43
               00 75 00 72 00 72 00 65 00 6E 00 74 00 55 00 73
               00 72 00 3A 00 20 00 7B 00 30 00 7D 00 0A 00 00
               17 54 00 69 00 6D 00 65 00 5A 00 3A 00 20 00 7B
               00 30 00 7D }
      $x2 = "\\Desktop\\cannon\\obj\\" ascii
      $x3 = "C:\\Users\\Public\\Music\\s.txt" fullword wide

      $s1 = "C:\\Documents and Settings\\All Users\\Documents" fullword wide
      $s2 = "notEncoded - Value here is never used" fullword wide
      $s3 = "Windows NT\\CurrentVersion\\Winlogon\"" fullword wide
      $s4 = "AnswerMessageTraverser`1" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and 1 of ($x*) or 3 of them
}
YARA Detection Rule: BKDR_Snarasite_Oct17
Repository: Neo23x0/signature-base
Detects: Auto-generated rule
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Detection condition:
uint16(0) == 0x5a4d and filesize < 3000KB and (
         pe.imphash() == "322bef04e1e1ac48875036e38fb5c23c" or
         pe.imphash() == "[PII_REDACTED]513c92fa36ba5590e907b"
      )

Full rule:
rule BKDR_Snarasite_Oct17 {
   meta:
      description = "Auto-generated rule"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-10-07"
      hash1 = "36ba92cba23971ca9d16a0b4f45c853fd5b[PII_REDACTED]d5f2027b0f56054fd62"
      id = "3a5d156a-529b-52ae-9b6a-d454895eb1fb"
   condition:
      uint16(0) == 0x5a4d and filesize < 3000KB and (
         pe.imphash() == "322bef04e1e1ac48875036e38fb5c23c" or
         pe.imphash() == "[PII_REDACTED]513c92fa36ba5590e907b"
      )
}
YARA Detection Rule: Industroyer_Malware_1
Repository: Neo23x0/signature-base
Detects: Detects Industroyer related malware
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/x81cSy

Pattern signatures:
$s1 = "haslo.exe" fullword ascii
      $s2 = "SYSTEM\\CurrentControlSet\\Services\\%ls" fullword wide
      $s3 = "SYS_BASCON.COM" fullword wide
      $s4 = "*.pcmt" fullword wide
      $s5 = "*.pcmi" fullword wide

      $x1 = { 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73
         00 5C 00 25 00 6C 00 73 00 00 00 49 00 6D 00 61
         00 67 00 65 00 50 00 61 00 74 00 68 00 00 00 43
         00 3A 00 5C 00 00 00 44 00 3A 00 5C 00 00 00 45
         00 3A 00 5C 00 00 00 }
      $x2 = "haslo.dat\x00Crash"

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and 1 of ($x*) or 2 of them )

Full rule:
rule Industroyer_Malware_1 {
   meta:
      description = "Detects Industroyer related malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/x81cSy"
      date = "2017-06-13"
      hash1 = "ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910"
      hash2 = "018eb62e174efdcdb3af011d34b0bf2284ed1a803718fba6edffe5bc0b446b81"
      id = "f5ab571c-03a7-538a-ada1-0930d15af5cf"
   strings:
      $s1 = "haslo.exe" fullword ascii
      $s2 = "SYSTEM\\CurrentControlSet\\Services\\%ls" fullword wide
      $s3 = "SYS_BASCON.COM" fullword wide
      $s4 = "*.pcmt" fullword wide
      $s5 = "*.pcmi" fullword wide

      $x1 = { 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73
         00 5C 00 25 00 6C 00 73 00 00 00 49 00 6D 00 61
         00 67 00 65 00 50 00 61 00 74 00 68 00 00 00 43
         00 3A 00 5C 00 00 00 44 00 3A 00 5C 00 00 00 45
         00 3A 00 5C 00 00 00 }
      $x2 = "haslo.dat\x00Crash"
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and 1 of ($x*) or 2 of them )
}
YARA Detection Rule: Industroyer_Portscan_3
Repository: Neo23x0/signature-base
Detects: Detects Industroyer related custom port scaner
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/x81cSy

Pattern signatures:
$s1 = "!ZBfamily" fullword ascii
      $s2 = ":g/outddomo;" fullword ascii
      $s3 = "GHIJKLMNOTST" fullword ascii
      /* Decompressed File */
      $d1 = "Error params Arguments!!!" fullword wide
      $d2 = "^(.+?.exe).*\\s+-ip\\s*=\\s*(.+)\\s+-ports\\s*=\\s*(.+)$" fullword wide
      $d3 = "Exhample:App.exe -ip= 127.0.0.1-100," fullword wide
      $d4 = "Error IP Range %ls - %ls" fullword wide
      $d5 = "Can't closesocket." fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 500KB and all of ($s*) or 2 of ($d*) )

Full rule:
rule Industroyer_Portscan_3 {
   meta:
      description = "Detects Industroyer related custom port scaner"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/x81cSy"
      date = "2017-06-13"
      hash1 = "893e4cca7fe58191d2f6722b383b5e8009d3885b5913dcd2e3577e5a763cdb3f"
      id = "f6675466-d469-562b-9fb6-7b72bce8a726"
   strings:
      $s1 = "!ZBfamily" fullword ascii
      $s2 = ":g/outddomo;" fullword ascii
      $s3 = "GHIJKLMNOTST" fullword ascii
      /* Decompressed File */
      $d1 = "Error params Arguments!!!" fullword wide
      $d2 = "^(.+?.exe).*\\s+-ip\\s*=\\s*(.+)\\s+-ports\\s*=\\s*(.+)$" fullword wide
      $d3 = "Exhample:App.exe -ip= 127.0.0.1-100," fullword wide
      $d4 = "Error IP Range %ls - %ls" fullword wide
      $d5 = "Can't closesocket." fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 500KB and all of ($s*) or 2 of ($d*) )
}
YARA Detection Rule: Industroyer_Portscan_3_Output
Repository: Neo23x0/signature-base
Detects: Detects Industroyer related custom port scaner output file
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/x81cSy

Pattern signatures:
$s1 = "WSA library load complite." fullword ascii
      $s2 = "Connection refused" fullword ascii

Detection condition:
all of them

Full rule:
rule Industroyer_Portscan_3_Output {
   meta:
      description = "Detects Industroyer related custom port scaner output file"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/x81cSy"
      date = "2017-06-13"
      id = "4469f056-674c-5a44-84a5-12a65b8586d5"
   strings:
      $s1 = "WSA library load complite." fullword ascii
      $s2 = "Connection refused" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: Industroyer_Malware_4
Repository: Neo23x0/signature-base
Detects: Detects Industroyer related malware
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/x81cSy

Pattern signatures:
$s1 = "haslo.dat" fullword wide
      $s2 = "defragsvc" fullword ascii

      /* .dat\x00\x00Crash */
      $a1 = { 00 2E 00 64 00 61 00 74 00 00 00 43 72 61 73 68 00 00 00 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and all of ($s*) or $a1 )

Full rule:
rule Industroyer_Malware_4 {
   meta:
      description = "Detects Industroyer related malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/x81cSy"
      date = "2017-06-13"
      hash1 = "21c1fdd6cfd8ec3ffe3e922f944424b543643dbdab99fa731556f8805b0d5561"
      id = "f197d2a5-eecb-51ed-b991-7643efb3f749"
   strings:
      $s1 = "haslo.dat" fullword wide
      $s2 = "defragsvc" fullword ascii

      /* .dat\x00\x00Crash */
      $a1 = { 00 2E 00 64 00 61 00 74 00 00 00 43 72 61 73 68 00 00 00 }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and all of ($s*) or $a1 )
}
YARA Detection Rule: Industroyer_Malware_5
Repository: Neo23x0/signature-base
Detects: Detects Industroyer related malware
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/x81cSy

Pattern signatures:
$x1 = "D2MultiCommService.exe" fullword ascii
      $x2 = "Crash104.dll" fullword ascii
      $x3 = "iec104.log" fullword ascii
      $x4 = "IEC-104 client: ip=%s; port=%s; ASDU=%u " fullword ascii

      $s1 = "Error while getaddrinfo executing: %d" fullword ascii
      $s2 = "return info-Remote command" fullword ascii
      $s3 = "Error killing process ..." fullword ascii
      $s4 = "stop_comm_service_name" fullword ascii
      $s5 = "*1* Data exchange: Send: %d (%s)" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 400KB and ( 1 of ($x*) or 4 of them ) ) or ( all of them )

Full rule:
rule Industroyer_Malware_5 {
   meta:
      description = "Detects Industroyer related malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/x81cSy"
      date = "2017-06-13"
      hash1 = "7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad"
      id = "52ce21a0-0c72-585c-a805-c5077a7445af"
   strings:
      $x1 = "D2MultiCommService.exe" fullword ascii
      $x2 = "Crash104.dll" fullword ascii
      $x3 = "iec104.log" fullword ascii
      $x4 = "IEC-104 client: ip=%s; port=%s; ASDU=%u " fullword ascii

      $s1 = "Error while getaddrinfo executing: %d" fullword ascii
      $s2 = "return info-Remote command" fullword ascii
      $s3 = "Error killing process ..." fullword ascii
      $s4 = "stop_comm_service_name" fullword ascii
      $s5 = "*1* Data exchange: Send: %d (%s)" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 400KB and ( 1 of ($x*) or 4 of them ) ) or ( all of them )
}
YARA Detection Rule: M_APT_Downloader_BEATDROP
Repository: Neo23x0/signature-base
Detects: Rule looking for BEATDROP malware
Author: Mandiant
Reference: https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns

Pattern signatures:
$ntdll1 = "ntdll" ascii fullword
      $ntdll2 = "C:\\Windows\\System32\\ntdll.dll" ascii fullword nocase
      $url1 = "api.trello.com" ascii
      $url2 = "/members/me/boards?key=" ascii
      $url3 = "/cards?key=" ascii

Detection condition:
uint16(0) == 0x5a4d and uint32(uint32(0x3C)) == 0x00004550 and filesize < 1MB and all of them

Full rule:
rule M_APT_Downloader_BEATDROP {
   meta:
      author = "Mandiant"
      description = "Rule looking for BEATDROP malware"
      reference = "https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns"
      date = "2022-04-28"
      score = 90
      id = "5720870e-8989-59f2-998b-019084d091ce"
   strings:
      $ntdll1 = "ntdll" ascii fullword
      $ntdll2 = "C:\\Windows\\System32\\ntdll.dll" ascii fullword nocase
      $url1 = "api.trello.com" ascii
      $url2 = "/members/me/boards?key=" ascii
      $url3 = "/cards?key=" ascii
   condition:
      uint16(0) == 0x5a4d and uint32(uint32(0x3C)) == 0x00004550 and filesize < 1MB and all of them
}
YARA Detection Rule: M_APT_Downloader_BOOMMIC
Repository: Neo23x0/signature-base
Detects: Rule looking for BOOMMIC malware
Author: Mandiant
Reference: https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns

Pattern signatures:
$loc_10001000 = { 55 8B EC 8D 45 0C 50 8B 4D 08 51 6A 02 FF 15 [4] 85 C0 74 09 B8 01 00 00 00 EB 04 EB 02 33 C0 5D C3 }
      $loc_100012fd = {6A 00 8D 55 EC 52 8B 45 D4 50 6A 05 8B 4D E4 51 FF 15 }
      $func1 = "GetComputerNameExA" ascii
      $func2 = "HttpQueryInfoA" ascii

Detection condition:
uint16(0) == 0x5a4d and uint32(uint32(0x3C)) == 0x00004550 and filesize < 1MB and
      (
         ($loc_10001000 and $func1) or
         ($loc_100012fd and $func2)
      )

Full rule:
rule M_APT_Downloader_BOOMMIC {
   meta:
      author = "Mandiant"
      description = "Rule looking for BOOMMIC malware"
      reference = "https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns"
      date = "2022-04-28"
      score = 75
      id = "34ea08a6-5d6f-5cdd-a629-fa36313c98f7"
   strings:
      $loc_10001000 = { 55 8B EC 8D 45 0C 50 8B 4D 08 51 6A 02 FF 15 [4] 85 C0 74 09 B8 01 00 00 00 EB 04 EB 02 33 C0 5D C3 }
      $loc_100012fd = {6A 00 8D 55 EC 52 8B 45 D4 50 6A 05 8B 4D E4 51 FF 15 }
      $func1 = "GetComputerNameExA" ascii
      $func2 = "HttpQueryInfoA" ascii
   condition:
      uint16(0) == 0x5a4d and uint32(uint32(0x3C)) == 0x00004550 and filesize < 1MB and
      (
         ($loc_10001000 and $func1) or
         ($loc_100012fd and $func2)
      )
}