deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: is__hex_mid_mandibule32
Repository: Yara-Rules/rules
Author: unixfreaxjp

Pattern signatures:
$hex05 = { E8 09 07 00 00 81 C1 FC 1F 00 00 8D 81 26 E1 FF FF } // st
		$hex06 = { 56 53 83 EC 24 E8 E1 05 00 00 81 C3 D0 1E 00 00 8B 44 24 30} // mn
		$hex07 = { 81 C3 E8 29 00 00 C7 44 24 0C } // pt
		$hex08 = { E8 C6 D5 FF FF 83 C4 0C 68 00 01 00 00 } // ld

Detection condition:
3 of them

Full rule:
private rule is__hex_mid_mandibule32 {
	meta:
		author = "unixfreaxjp"
		date = "2018-06-01"
	strings:
		$hex05 = { E8 09 07 00 00 81 C1 FC 1F 00 00 8D 81 26 E1 FF FF } // st
		$hex06 = { 56 53 83 EC 24 E8 E1 05 00 00 81 C3 D0 1E 00 00 8B 44 24 30} // mn
		$hex07 = { 81 C3 E8 29 00 00 C7 44 24 0C } // pt
		$hex08 = { E8 C6 D5 FF FF 83 C4 0C 68 00 01 00 00 } // ld
	condition:
                3 of them 
}
YARA Detection Rule: TOOLKIT_Mandibule
Repository: Yara-Rules/rules
Detects: Generic detection for ELF Linux process injector mandibule generic
Author: unixfreaxjp
Reference: https://imgur.com/a/MuHSZtC

Detection condition:
((is__str_mandibule_gen1) or (is__hex_mid_mandibule32))
		or ((is__str_mandibule_gen1) or (is__hex_top_mandibule64))
		and is__elf
		and filesize < 30KB

Full rule:
rule TOOLKIT_Mandibule {
	meta:
		description = "Generic detection for ELF Linux process injector mandibule generic"
		reference = "https://imgur.com/a/MuHSZtC"
		author = "unixfreaxjp"
		org = "MalwareMustDie"
		date = "2018-06-01"
	condition:
		((is__str_mandibule_gen1) or (is__hex_mid_mandibule32))
		or ((is__str_mandibule_gen1) or (is__hex_top_mandibule64))
		and is__elf
		and filesize < 30KB 
}
YARA Detection Rule: Sofacy_Fybis_ELF_Backdoor_Gen1
Repository: Yara-Rules/rules
Detects: Detects Sofacy Fysbis Linux Backdoor_Naikon_APT_Sample1
Author: Florian Roth
Reference: http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/

Pattern signatures:
$x1 = "Your command not writed to pipe" fullword ascii
        $x2 = "Terminal don`t started for executing command" fullword ascii
        $x3 = "Command will have end with \\n" fullword ascii
        $s1 = "WantedBy=multi-user.target' >> /usr/lib/systemd/system/" fullword ascii
        $s2 = "Success execute command or long for waiting executing your command" fullword ascii
        $s3 = "ls /etc | egrep -e\"fedora*|debian*|gentoo*|mandriva*|mandrake*|meego*|redhat*|lsb-*|sun-*|SUSE*|release\"" fullword ascii
        $s4 = "rm -f /usr/lib/systemd/system/" fullword ascii
        $s5 = "ExecStart=" fullword ascii
        $s6 = "<table><caption><font size=4 color=red>TABLE EXECUTE FILES</font></caption>" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 500KB and 1 of ($x*) ) or ( 1 of ($x*) and 3 of ($s*) )

Full rule:
rule Sofacy_Fybis_ELF_Backdoor_Gen1
{
    
    meta:
        description = "Detects Sofacy Fysbis Linux Backdoor_Naikon_APT_Sample1"
        author = "Florian Roth"
        reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
        date = "2016-02-13"
        score = 80
        hash1 = "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592"
        hash2 = "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb"
    
    strings:
        $x1 = "Your command not writed to pipe" fullword ascii
        $x2 = "Terminal don`t started for executing command" fullword ascii
        $x3 = "Command will have end with \\n" fullword ascii
        $s1 = "WantedBy=multi-user.target' >> /usr/lib/systemd/system/" fullword ascii
        $s2 = "Success execute command or long for waiting executing your command" fullword ascii
        $s3 = "ls /etc | egrep -e\"fedora*|debian*|gentoo*|mandriva*|mandrake*|meego*|redhat*|lsb-*|sun-*|SUSE*|release\"" fullword ascii
        $s4 = "rm -f /usr/lib/systemd/system/" fullword ascii
        $s5 = "ExecStart=" fullword ascii
        $s6 = "<table><caption><font size=4 color=red>TABLE EXECUTE FILES</font></caption>" fullword ascii

    condition:
        ( uint16(0) == 0x457f and filesize < 500KB and 1 of ($x*) ) or ( 1 of ($x*) and 3 of ($s*) )
}
YARA Detection Rule: Sofacy_Fysbis_ELF_Backdoor_Gen2
Repository: Yara-Rules/rules
Detects: Detects Sofacy Fysbis Linux Backdoor
Author: Florian Roth
Reference: http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/

Pattern signatures:
$s1 = "RemoteShell" ascii
        $s2 = "basic_string::_M_replace_dispatch" fullword ascii
        $s3 = "HttpChannel" ascii

Detection condition:
uint16(0) == 0x457f and filesize < 500KB and all of them

Full rule:
rule Sofacy_Fysbis_ELF_Backdoor_Gen2 
{

    meta:
        description = "Detects Sofacy Fysbis Linux Backdoor"
        author = "Florian Roth"
        reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
        date = "2016-02-13"
        score = 80
        hash1 = "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592"
        hash2 = "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb"
        hash3 = "fd8b2ea9a2e8a67e4cb3904b49c789d57ed9b1ce5bebfe54fe3d98214d6a0f61"
  
    strings:
        $s1 = "RemoteShell" ascii
        $s2 = "basic_string::_M_replace_dispatch" fullword ascii
        $s3 = "HttpChannel" ascii
  
    condition:
        uint16(0) == 0x457f and filesize < 500KB and all of them
}
YARA Detection Rule: MSILStealer
Repository: Yara-Rules/rules
Detects: Detects strings from C#/VB Stealers and QuasarRat
Author: https://github.com/hwvs
Reference: https://github.com/quasar/QuasarRAT

Pattern signatures:
$ = "Firefox does not have any profiles, has it ever been launched?" wide ascii
        $ = "Firefox is not installed, or the install path could not be located" wide ascii
        $ = "No installs of firefox recorded in its key." wide ascii
        $ = "{0}\\\\FileZilla\\\\recentservers.xml" wide ascii
        $ = "{1}{0}Cookie Name: {2}{0}Value: {3}{0}Path" wide ascii
        $ = "[PRIVATE KEY LOCATION: \\\"{0}\\\"]" wide ascii

Detection condition:
1 of them

Full rule:
rule MSILStealer
{
    meta:
        description = "Detects strings from C#/VB Stealers and QuasarRat"
        reference = "https://github.com/quasar/QuasarRAT"
        author = "https://github.com/hwvs"
        last_modified = "2019-11-21"

    strings:
        $ = "Firefox does not have any profiles, has it ever been launched?" wide ascii
        $ = "Firefox is not installed, or the install path could not be located" wide ascii
        $ = "No installs of firefox recorded in its key." wide ascii
        $ = "{0}\\\\FileZilla\\\\recentservers.xml" wide ascii
        $ = "{1}{0}Cookie Name: {2}{0}Value: {3}{0}Path" wide ascii
        $ = "[PRIVATE KEY LOCATION: \\\"{0}\\\"]" wide ascii

    condition:
        1 of them
}
YARA Detection Rule: locdoor_ransomware
Repository: Yara-Rules/rules
Detects: Rule to detect Locdoor/DryCry
Author: Marc Rivero | @seifreed
Reference: https://twitter.com/leotpsc/status/[PII_REDACTED]44376832

Pattern signatures:
$s1 = "copy \"Locdoor.exe\" \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\temp00000000.exe\"" fullword ascii
      $s2 = "copy wscript.vbs C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\wscript.vbs" fullword ascii
      $s3 = "!! Your computer's important files have been encrypted! Your computer's important files have been encrypted!" fullword ascii
      $s4 = "echo CreateObject(\"SAPI.SpVoice\").Speak \"Your computer's important files have been encrypted! " fullword ascii    
      $s5 = "! Your computer's important files have been encrypted! " fullword ascii
      $s7 = "This program is not supported on your operating system." fullword ascii
      $s8 = "echo Your computer's files have been encrypted to Locdoor Ransomware! To make a recovery go to localbitcoins.com and create a wa" ascii
      $s9 = "Please enter the password." fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 600KB ) and all of them

Full rule:
rule locdoor_ransomware {

   meta:

      description = "Rule to detect Locdoor/DryCry"
      author = "Marc Rivero | @seifreed"
      reference = "https://twitter.com/leotpsc/status/[PII_REDACTED]44376832"

   strings:

      $s1 = "copy \"Locdoor.exe\" \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\temp00000000.exe\"" fullword ascii
      $s2 = "copy wscript.vbs C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\wscript.vbs" fullword ascii
      $s3 = "!! Your computer's important files have been encrypted! Your computer's important files have been encrypted!" fullword ascii
      $s4 = "echo CreateObject(\"SAPI.SpVoice\").Speak \"Your computer's important files have been encrypted! " fullword ascii    
      $s5 = "! Your computer's important files have been encrypted! " fullword ascii
      $s7 = "This program is not supported on your operating system." fullword ascii
      $s8 = "echo Your computer's files have been encrypted to Locdoor Ransomware! To make a recovery go to localbitcoins.com and create a wa" ascii
      $s9 = "Please enter the password." fullword ascii

   condition:

      ( uint16(0) == 0x5a4d and filesize < 600KB ) and all of them 
}
YARA Detection Rule: Madness
Repository: Yara-Rules/rules
Detects: Identify Madness Pro DDoS Malware
Author: Jason Jones <jasonjones@arbor.net>

Pattern signatures:
$ua1 = "TW96aWxsYS81LjAgKFdpbmRvd3M7IFU7IFdpbmRvd3MgTlQgNS4xOyBlbi1VUzsgcnY6MS44LjAuNSkgR2Vja28vMjAwNjA3MzEgRmlyZWZveC8xLjUuMC41IEZsb2NrLzAuNy40LjE"
        $ua2 = "TW96aWxsYS81LjAgKFgxMTsgVTsgTGludXggMi40LjItMiBpNTg2OyBlbi1VUzsgbTE4KSBHZWNrby8yMDAxMDEzMSBOZXRzY2FwZTYvNi4wMQ=="
        $str1= "document.cookie=" fullword
        $str2 = "[\"cookie\",\"" fullword
        $str3 = "\"realauth=" fullword
        $str4 = "\"location\"];" fullword
        $str5 = "d3Rm" fullword
        $str6 = "ZXhl" fullword

Detection condition:
all of them

Full rule:
rule Madness : DoS {
    meta:
        author = "Jason Jones <jasonjones@arbor.net>"
        date = "2014-01-15"
        description = "Identify Madness Pro DDoS Malware"
        source = "https://github.com/arbor/yara/blob/master/madness.yara"
    strings:
        $ua1 = "TW96aWxsYS81LjAgKFdpbmRvd3M7IFU7IFdpbmRvd3MgTlQgNS4xOyBlbi1VUzsgcnY6MS44LjAuNSkgR2Vja28vMjAwNjA3MzEgRmlyZWZveC8xLjUuMC41IEZsb2NrLzAuNy40LjE"
        $ua2 = "TW96aWxsYS81LjAgKFgxMTsgVTsgTGludXggMi40LjItMiBpNTg2OyBlbi1VUzsgbTE4KSBHZWNrby8yMDAxMDEzMSBOZXRzY2FwZTYvNi4wMQ=="
        $str1= "document.cookie=" fullword
        $str2 = "[\"cookie\",\"" fullword
        $str3 = "\"realauth=" fullword
        $str4 = "\"location\"];" fullword
        $str5 = "d3Rm" fullword
        $str6 = "ZXhl" fullword
    condition:
        all of them
}
YARA Detection Rule: blackpos_v2
Repository: Yara-Rules/rules
Author: @patrickrolsen
Reference: http://blog.nuix.com/2014/09/08/blackpos-v2-new-variant-or-different-family

Pattern signatures:
$s1 = "Usage: -[start|stop|install|uninstall"
	$s2 = "\\SYSTEM32\\sc.exe config LanmanWorkstation"
	$s3 = "t.bat"
	$s4 = "mcfmisvc"

Detection condition:
uint16(0) == 0x5A4D and all of ($s*)

Full rule:
rule blackpos_v2
{
meta:
	author = "@patrickrolsen"
	version = "0.1"
	reference = "http://blog.nuix.com/2014/09/08/blackpos-v2-new-variant-or-different-family"
strings:
	$s1 = "Usage: -[start|stop|install|uninstall"
	$s2 = "\\SYSTEM32\\sc.exe config LanmanWorkstation"
	$s3 = "t.bat"
	$s4 = "mcfmisvc"
condition:
	uint16(0) == 0x5A4D and all of ($s*)
}
YARA Detection Rule: dump_tool
Repository: Yara-Rules/rules
Author: @patrickrolsen
Reference: Related to pwdump6 and fgdump tools

Pattern signatures:
$s1 = "lsremora"
	$s2 = "servpw"
	$s3 = "failed: %d"
	$s4 = "fgdump"
	$s5 = "fgexec"
	$s6 = "fgexecpipe"

Detection condition:
uint16(0) == 0x5A4D and 3 of ($s*)

Full rule:
rule dump_tool
{
meta:
	author = "@patrickrolsen"
	reference = "Related to pwdump6 and fgdump tools"
strings:
	$s1 = "lsremora"
	$s2 = "servpw"
	$s3 = "failed: %d"
	$s4 = "fgdump"
	$s5 = "fgexec"
	$s6 = "fgexecpipe"
condition:
	uint16(0) == 0x5A4D and 3 of ($s*)
}
YARA Detection Rule: osql_tool
Repository: Yara-Rules/rules
Author: @patrickrolsen
Reference: O/I SQL - SQL query tool

Pattern signatures:
$s1 = "osql\\src"
	$s2 = "OSQLUSER"
	$s3 = "OSQLPASSWORD"
	$s4 = "OSQLSERVER"

Detection condition:
uint16(0) == 0x5A4D and (all of ($s*))

Full rule:
rule osql_tool
{
meta:
	author = "@patrickrolsen"
	reference = "O/I SQL - SQL query tool"
	filetype = "EXE"
	version = "0.1"
	date = "1/30/2014"
strings:
	$s1 = "osql\\src"
	$s2 = "OSQLUSER"
	$s3 = "OSQLPASSWORD"
	$s4 = "OSQLSERVER"
condition:
	uint16(0) == 0x5A4D and (all of ($s*))
}
YARA Detection Rule: misc_pos
Repository: Yara-Rules/rules
Author: @patrickrolsen
Reference: POS Malware

Pattern signatures:
$s1 = "KAPTOXA"
	$s2 = "cmd /c net start %s"
	$s3 = "pid:"
	$s4 = "%ADD%"
	$s5 = "COMSPEC"
	$s6 = "KARTOXA"

Detection condition:
uint16(0) == 0x5A4D and 3 of ($s*)

Full rule:
rule misc_pos
{
meta:
	author = "@patrickrolsen"
	reference = "POS Malware"
strings:
	$s1 = "KAPTOXA"
	$s2 = "cmd /c net start %s"
	$s3 = "pid:"
	$s4 = "%ADD%"
	$s5 = "COMSPEC"
	$s6 = "KARTOXA"
condition:
	uint16(0) == 0x5A4D and 3 of ($s*)
}
YARA Detection Rule: unknown
Repository: Yara-Rules/rules
Author: @patrickrolsen
Reference: Unknown POS

Pattern signatures:
$s1 = "a.exe" wide
	$s2 = "Can anyone test" wide
	$s3 = "I m in computer class now" wide

Detection condition:
uint16(0) == 0x5A4D and 3 of ($s*)

Full rule:
rule unknown
{
meta:
	author = "@patrickrolsen"
	reference = "Unknown POS"
strings:
	$s1 = "a.exe" wide
	$s2 = "Can anyone test" wide
	$s3 = "I m in computer class now" wide
condition:
	uint16(0) == 0x5A4D and 3 of ($s*)
}
YARA Detection Rule: regex_pos
Repository: Yara-Rules/rules
Author: @patrickrolsen
Reference: POS malware - Regex

Pattern signatures:
$n1 = "REGEXEND" nocase
	$n2 = "RegExpr" nocase
	$n3 = "regex"
	$s4 = "[1-5][0-9]{14}=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}[0-9]*"
	$s5 = "[47][0-9]{13}=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}[0-9]*"
	$s6 = "(?:0[0-5]|[68][0-9])[0-9]{11}=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}[0-9]*"
	$s7 = "(?:011|5[0-9]{2})[0-9]{12}=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}[0-9]*"
	$s8 = "(?:2131|1800|35\\d{3})\\d{11}=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}[0-9]*"
	$s9 = "([0-9]{15,16}[D=](0[7-9]|1[0-5])((0[1-9])|(1[0-2]))[0-9]{8,30})"
	$s10 = "((b|B)[0-9]{13,19}\\^[A-Za-z\\s]{0,30}\\/[A-Za-z\\s]{0,30}\\^(0[7-9]|1[0-5])((0[1-9])|(1[0-2]))[0-9\\s]{3,50}[0-9]{1})"
	$s11 = "[0-9]*\\^[a-zA-Z]*/[a-zA-Z ]*\\^[0-9]*"
	$s12 = "\\d{15,19}=\\d{13,}"
	$s13 = "\\;?[3-9]{1}[0-9]{12,19}[D=\\u0061][0-9]{10,30}\\??"
	$s14 = "[0-9]{12}(?:[0-9]{3})?=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}

Detection condition:
uint16(0) == 0x5A4D and 1 of ($n*) and 1 of ($s*)

Full rule:
rule regex_pos
{
meta:
	author = "@patrickrolsen"
	reference = "POS malware - Regex"
strings:
	$n1 = "REGEXEND" nocase
	$n2 = "RegExpr" nocase
	$n3 = "regex"
	$s4 = "[1-5][0-9]{14}=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}[0-9]*"
	$s5 = "[47][0-9]{13}=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}[0-9]*"
	$s6 = "(?:0[0-5]|[68][0-9])[0-9]{11}=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}[0-9]*"
	$s7 = "(?:011|5[0-9]{2})[0-9]{12}=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}[0-9]*"
	$s8 = "(?:2131|1800|35\\d{3})\\d{11}=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}[0-9]*"
	$s9 = "([0-9]{15,16}[D=](0[7-9]|1[0-5])((0[1-9])|(1[0-2]))[0-9]{8,30})"
	$s10 = "((b|B)[0-9]{13,19}\\^[A-Za-z\\s]{0,30}\\/[A-Za-z\\s]{0,30}\\^(0[7-9]|1[0-5])((0[1-9])|(1[0-2]))[0-9\\s]{3,50}[0-9]{1})"
	$s11 = "[0-9]*\\^[a-zA-Z]*/[a-zA-Z ]*\\^[0-9]*"
	$s12 = "\\d{15,19}=\\d{13,}"
	$s13 = "\\;?[3-9]{1}[0-9]{12,19}[D=\\u0061][0-9]{10,30}\\??"
	$s14 = "[0-9]{12}(?:[0-9]{3})?=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}[0-9]*"
condition:
	uint16(0) == 0x5A4D and 1 of ($n*) and 1 of ($s*)
}
YARA Detection Rule: regexpr_pos
Repository: Yara-Rules/rules
Author: @patrickrolsen
Reference: POS malware - RegExpr

Pattern signatures:
$s1 = "RegExpr" nocase
	$s2 = "Data.txt"
	$s3 = "Track1"
	$s4 = "Track2"

Detection condition:
uint16(0) == 0x5A4D and 3 of ($s*)

Full rule:
rule regexpr_pos
{
meta:
	author = "@patrickrolsen"
	reference = "POS malware - RegExpr"
strings:
	$s1 = "RegExpr" nocase
	$s2 = "Data.txt"
	$s3 = "Track1"
	$s4 = "Track2"
condition:
	uint16(0) == 0x5A4D and 3 of ($s*)
}
YARA Detection Rule: reg_pos
Repository: Yara-Rules/rules
Author: @patrickrolsen
Reference: POS malware - RegExpr

Pattern signatures:
$s1 = "T1_FOUND: %s"
	$s2 = "id=%s&log=%s"
	$s3 = "\\d{15,19}=\\d{13,}"

Detection condition:
uint16(0) == 0x5A4D and 2 of ($s*)

Full rule:
rule reg_pos
{
meta:
	author = "@patrickrolsen"
	reference = "POS malware - RegExpr"
strings:
	$s1 = "T1_FOUND: %s"
	$s2 = "id=%s&log=%s"
	$s3 = "\\d{15,19}=\\d{13,}"
condition:
	uint16(0) == 0x5A4D and 2 of ($s*)
}
YARA Detection Rule: sets_pos
Repository: Yara-Rules/rules
Author: @patrickrolsen
Reference: POS malware - Sets

Pattern signatures:
$s1 = "GET /sets.txt"

Detection condition:
uint16(0) == 0x5A4D and $s1

Full rule:
rule sets_pos
{
meta:
	author = "@patrickrolsen"
	reference = "POS malware - Sets"
strings:
	$s1 = "GET /sets.txt"
condition:
	uint16(0) == 0x5A4D and $s1
}
YARA Detection Rule: monitor_tool_pos
Repository: Yara-Rules/rules
Author: @patrickrolsen
Reference: POS malware - Monitoring Tool??

Pattern signatures:
$s1 = "RCPT TO"
	$s2 = "MAIL FROM"
	$s3 = "AUTH LOGIN"
	$s4 = "Reply-To"
	$s5 = "X-Mailer"
	$s6 = "crypto"
	$s7 = "test335.txt" wide
	$s8 = "/c del"

Detection condition:
uint16(0) == 0x5A4D and 7 of ($s*)

Full rule:
rule monitor_tool_pos
{
meta:
	author = "@patrickrolsen"
	reference = "POS malware - Monitoring Tool??"
strings:
	$s1 = "RCPT TO"
	$s2 = "MAIL FROM"
	$s3 = "AUTH LOGIN"
	$s4 = "Reply-To"
	$s5 = "X-Mailer"
	$s6 = "crypto"
	$s7 = "test335.txt" wide
	$s8 = "/c del"
condition:
	uint16(0) == 0x5A4D and 7 of ($s*)
}
YARA Detection Rule: pstgdump
Repository: Yara-Rules/rules
Author: @patrickrolsen
Reference: pstgdump

Pattern signatures:
$s1 = "fgdump\\pstgdump"
	$s2 = "pstgdump"
	$s3 = "Outlook"

Detection condition:
uint16(0) == 0x5A4D and all of ($s*)

Full rule:
rule pstgdump
{
meta:
	author = "@patrickrolsen"
	reference = "pstgdump"
strings:
	$s1 = "fgdump\\pstgdump"
	$s2 = "pstgdump"
	$s3 = "Outlook"
condition:
	uint16(0) == 0x5A4D and all of ($s*)
}
YARA Detection Rule: keyfinder_tool
Repository: Yara-Rules/rules
Author: @patrickrolsen
Reference: Magical Jelly Bean KeyFinder

Pattern signatures:
$s1 = "chgxp.vbs"
	$s2 = "officekey.exe"
	$s3 = "findkey.exe"
	$s4 = "xpkey.exe"

Detection condition:
uint16(0) == 0x5A4D and 2 of ($s*)

Full rule:
rule keyfinder_tool
{
meta:
	author = "@patrickrolsen"
	reference = "Magical Jelly Bean KeyFinder"
strings:
	$s1 = "chgxp.vbs"
	$s2 = "officekey.exe"
	$s3 = "findkey.exe"
	$s4 = "xpkey.exe"
condition:
	uint16(0) == 0x5A4D and 2 of ($s*)
}
YARA Detection Rule: memdump_diablo
Repository: Yara-Rules/rules
Author: @patrickrolsen
Reference: Process Memory Dumper - DiabloHorn

Pattern signatures:
$s1 = "DiabloHorn"
	$s2 = "Process Memory Dumper"
	$s3 = "pid-%s.dmp"
	$s4 = "Pid %d in not acessible" // SIC
	$s5 = "memdump.exe"
	$s6 = "%s-%d.dmp"

Detection condition:
uint16(0) == 0x5A4D and 3 of ($s*)

Full rule:
rule memdump_diablo
{
meta:
	author = "@patrickrolsen"
	reference = "Process Memory Dumper - DiabloHorn"
strings:
	$s1 = "DiabloHorn"
	$s2 = "Process Memory Dumper"
	$s3 = "pid-%s.dmp"
	$s4 = "Pid %d in not acessible" // SIC
	$s5 = "memdump.exe"
	$s6 = "%s-%d.dmp"
condition:
	uint16(0) == 0x5A4D and 3 of ($s*)
}
YARA Detection Rule: blazingtools
Repository: Yara-Rules/rules
Author: @patrickrolsen
Reference: Blazing Tools - http://www.blazingtools.com (Keyloggers)

Pattern signatures:
$s1 = "blazingtools.com"
	$s2 = "Keystrokes" wide
	$s3 = "Screenshots" wide

Detection condition:
uint16(0) == 0x5A4D and all of ($s*)

Full rule:
rule blazingtools
{
meta:
	author = "@patrickrolsen"
	reference = "Blazing Tools - http://www.blazingtools.com (Keyloggers)"
strings:
	$s1 = "blazingtools.com"
	$s2 = "Keystrokes" wide
	$s3 = "Screenshots" wide
condition:
	uint16(0) == 0x5A4D and all of ($s*)
}
YARA Detection Rule: sysocmgr
Repository: Yara-Rules/rules
Author: @patrickrolsen
Reference: System stand-alone Optional Component Manager - http://support.microsoft.com/kb/222444

Pattern signatures:
$s1 = "SYSOCMGR.EXE" wide
	$s2 = "System stand-alone Optional Component Manager" wide

Detection condition:
uint16(0) == 0x5A4D and all of ($s*)

Full rule:
rule sysocmgr
{
meta:
	author = "@patrickrolsen"
	reference = "System stand-alone Optional Component Manager - http://support.microsoft.com/kb/222444"
strings:
	$s1 = "SYSOCMGR.EXE" wide
	$s2 = "System stand-alone Optional Component Manager" wide
condition:
	uint16(0) == 0x5A4D and all of ($s*)
}
YARA Detection Rule: lacy_keylogger
Repository: Yara-Rules/rules
Author: @patrickrolsen
Reference: Appears to be a form of keylogger.

Pattern signatures:
$s1 = "Lacy.exe" wide
	$s2 = "Bldg Chive Duel Rip Query" wide

Detection condition:
uint16(0) == 0x5A4D and all of ($s*)

Full rule:
rule lacy_keylogger
{
meta:
	author = "@patrickrolsen"
	reference = "Appears to be a form of keylogger."
strings:
	$s1 = "Lacy.exe" wide
	$s2 = "Bldg Chive Duel Rip Query" wide
condition:
	uint16(0) == 0x5A4D and all of ($s*)
}
YARA Detection Rule: searchinject
Repository: Yara-Rules/rules
Author: @patrickrolsen
Reference: Usage: SearchInject <PID1>[PID2][PID3] - It loads Searcher.dll (appears to be hard coded)

Pattern signatures:
$s1 = "SearchInject"
	$s2 = "inject base:"
	$s3 = "Searcher.dll" nocase

Detection condition:
uint16(0) == 0x5A4D and all of ($s*)

Full rule:
rule searchinject
{
meta:
	author = "@patrickrolsen"
	reference = "Usage: SearchInject <PID1>[PID2][PID3] - It loads Searcher.dll (appears to be hard coded)"
strings:
	$s1 = "SearchInject"
	$s2 = "inject base:"
	$s3 = "Searcher.dll" nocase
condition:
	uint16(0) == 0x5A4D and all of ($s*)
}
YARA Detection Rule: heistenberg_pos
Repository: Yara-Rules/rules
Author: @patrickrolsen
Reference: POS Malware

Pattern signatures:
$s1 = "KARTOXA"
	$s2 = "dmpz.log"
	$s3 = "/api/process.php?xy="
	$s4 = "User-Agent: PCICompliant" // PCICompliant/3.33
	$s6 = "%s:*:Enabled:%s"

Detection condition:
uint16(0) == 0x5A4D and 3 of ($s*)

Full rule:
rule heistenberg_pos
{
meta:
	author = "@patrickrolsen"
	reference = "POS Malware"
strings:
	$s1 = "KARTOXA"
	$s2 = "dmpz.log"
	$s3 = "/api/process.php?xy="
	$s4 = "User-Agent: PCICompliant" // PCICompliant/3.33
	$s6 = "%s:*:Enabled:%s"
condition:
	uint16(0) == 0x5A4D and 3 of ($s*)
}
YARA Detection Rule: pos_jack
Repository: Yara-Rules/rules
Author: @patrickrolsen
Reference: http://blog.spiderlabs.com/2014/02/jackpos-the-house-always-wins.html

Pattern signatures:
$pdb1 = "\\ziedpirate.ziedpirate-PC\\"
	$pdb2 = "\\sop\\sop\\"

Detection condition:
uint16(0) == 0x5A4D and 1 of ($pdb*)

Full rule:
rule pos_jack
{
meta:
	author = "@patrickrolsen"
	maltype = "Point of Sale (POS) Malware"
	version = "0.1"
	reference = "http://blog.spiderlabs.com/2014/02/jackpos-the-house-always-wins.html"
	date = "2/22/2014"
strings:
	$pdb1 = "\\ziedpirate.ziedpirate-PC\\"
	$pdb2 = "\\sop\\sop\\"
condition:
	uint16(0) == 0x5A4D and 1 of ($pdb*)
}
YARA Detection Rule: pos_memory_scrapper_
Repository: Yara-Rules/rules
Detects: POS Memory Scraper
Author: @patrickrolsen

Pattern signatures:
$s1 = "kartoxa" nocase
	$s2 = "CC2 region:"
	$s3 = "CC memregion:"
	$s4 = "target pid:"
	$s5 = "scan all processes:"
	$s6 = "<pid> <PATTERN>"
	$s7 = "KAPTOXA"
	$s8 = "ATTERN"
	$s9 = "\\svhst%p"

Detection condition:
uint16(0) == 0x5A4D and 3 of ($s*)

Full rule:
rule pos_memory_scrapper_
{
meta:
	author = "@patrickrolsen"
	maltype = "Point of Sale (POS) Malware Memory Scraper"
	version = "0.3"
	description = "POS Memory Scraper"
	date = "01/30/2014"
strings:
	$s1 = "kartoxa" nocase
	$s2 = "CC2 region:"
	$s3 = "CC memregion:"
	$s4 = "target pid:"
	$s5 = "scan all processes:"
	$s6 = "<pid> <PATTERN>"
	$s7 = "KAPTOXA"
	$s8 = "ATTERN"
	$s9 = "\\svhst%p"
condition:
	uint16(0) == 0x5A4D and 3 of ($s*)
}