deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: SUSP_Script_Base64_Blocks_Jun20_1
Repository: Neo23x0/signature-base
Detects: Detects suspicious file with base64 encoded payload in blocks
Author: Florian Roth (Nextron Systems)
Reference: https://posts.specterops.io/covenant-v0-5-eee0507b85ba

Pattern signatures:
$sa1 = "<script language=" ascii
      $sb2 = { 41 41 41 22 2B 0D 0A 22 41 41 41 }

Detection condition:
all of them

Full rule:
rule SUSP_Script_Base64_Blocks_Jun20_1 {
   meta:
      description = "Detects suspicious file with base64 encoded payload in blocks"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://posts.specterops.io/covenant-v0-5-eee0507b85ba"
      date = "2020-06-05"
      score = 70
      id = "cef759a5-b02a-53e7-bf27-184eee6bc3fa"
   strings:
      $sa1 = "<script language=" ascii
      $sb2 = { 41 41 41 22 2B 0D 0A 22 41 41 41 }
   condition:
      all of them
}
YARA Detection Rule: SUSP_Reversed_Hacktool_Author
Repository: Neo23x0/signature-base
Detects: Detects a suspicious path traversal into a Windows folder
Author: Florian Roth (Nextron Systems)
Reference: https://hackingiscool.pl/cmdhijack-command-argument-confusion-with-path-traversal-in-cmd-exe/

Pattern signatures:
$x1 = "iwiklitneg" fullword ascii wide
      $x2 = " eetbus@ " ascii wide

Detection condition:
filesize < 4000KB and
      1 of them

Full rule:
rule SUSP_Reversed_Hacktool_Author : FILE {
   meta:
      description = "Detects a suspicious path traversal into a Windows folder"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://hackingiscool.pl/cmdhijack-command-argument-confusion-with-path-traversal-in-cmd-exe/"
      date = "2020-06-10"
      score = 65
      id = "33e20d75-af07-5df2-82c3-c48aec37a947"
   strings:
      $x1 = "iwiklitneg" fullword ascii wide
      $x2 = " eetbus@ " ascii wide
   condition:
      filesize < 4000KB and
      1 of them
}
YARA Detection Rule: SUSP_Base64_Encoded_Hacktool_Dev
Repository: Neo23x0/signature-base
Detects: Detects a suspicious base64 encoded keyword
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/cyb3rops/status/[PII_REDACTED]26911744

Pattern signatures:
$ = "QGdlbnRpbGtpd2" ascii wide 
      $ = "BnZW50aWxraXdp" ascii wide 
      $ = "AZ2VudGlsa2l3a" ascii wide
      $ = "QGhhcm1qMH" ascii wide
      $ = "BoYXJtajB5" ascii wide
      $ = "AaGFybWowe" ascii wide
      $ = "IEBzdWJ0ZW" ascii wide
      $ = "BAc3VidGVl" ascii wide
      $ = "gQHN1YnRlZ" ascii wide

Detection condition:
filesize < 6000KB and 1 of them

Full rule:
rule SUSP_Base64_Encoded_Hacktool_Dev {
   meta:
      description = "Detects a suspicious base64 encoded keyword"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/cyb3rops/status/[PII_REDACTED]26911744"
      date = "2020-06-10"
      score = 65
      id = "6dc7db4b-a614-51e4-a9a5-f869154dbbb1"
   strings:
      $ = "QGdlbnRpbGtpd2" ascii wide 
      $ = "BnZW50aWxraXdp" ascii wide 
      $ = "AZ2VudGlsa2l3a" ascii wide
      $ = "QGhhcm1qMH" ascii wide
      $ = "BoYXJtajB5" ascii wide
      $ = "AaGFybWowe" ascii wide
      $ = "IEBzdWJ0ZW" ascii wide
      $ = "BAc3VidGVl" ascii wide
      $ = "gQHN1YnRlZ" ascii wide
   condition:
      filesize < 6000KB and 1 of them
}
YARA Detection Rule: UBoatRAT
Repository: Neo23x0/signature-base
Detects: Detects UBoat RAT Samples
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/

Pattern signatures:
$s1 = "URLDownloadToFileA" ascii
      $s2 = "GetModuleFileNameW" ascii
      $s4 = "WININET.dll" ascii
      $s5 = "urlmon.dll" ascii
      $s6 = "WTSAPI32.dll" ascii
      $s7 = "IPHLPAPI.DLL" ascii

      $op1 = { 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68
               69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F
               74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20
               6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 }

      $vprotect = { 2E 76 6D 70 30 }

Detection condition:
/* MZ and PE */
      uint16(0) == 0x5a4d and uint32(uint32(0x3c)) == 0x4550 and
      /* Expected file size */
      filesize < 1400KB and filesize > 800KB and (
         /* Imports */
         all of ($s*) and
         /* Specific header - possibly Yoda protector*/
         $op1 at 64 and
        

Full rule:
rule UBoatRAT {
   meta:
      description = "Detects UBoat RAT Samples"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/"
      date = "2017-11-29"
      hash1 = "04873dbd63279228a0a4bb1184933b64adb880e874bd3d14078161d06e232c9b"
      hash2 = "7b32f401e2ad577e8398b2975ecb5c5ce68c5b07717b1e0d762f90a6fbd8add1"
      hash3 = "42d8a84cd49ff3afacf3d549fbab1fa80d5eda0c8625938b6d32e18004b0edac"
      hash4 = "6bea49e4260f083ed6b73e100550ecd[PII_REDACTED]1f4a6326e0544272a84526c"
      hash5 = "cf832f32b8d27cf[PII_REDACTED]621c21bd3c20e71cc[PII_REDACTED]04dacf4dadb7"
      hash6 = "bf7c6e911f14a1f8679c9b0c2b183d74d5accd559e17297adcd173d76755e271"
      id = "f7f745c2-648d-5937-8d06-f5d1b6ed7e11"
   strings:
      $s1 = "URLDownloadToFileA" ascii
      $s2 = "GetModuleFileNameW" ascii
      $s4 = "WININET.dll" ascii
      $s5 = "urlmon.dll" ascii
      $s6 = "WTSAPI32.dll" ascii
      $s7 = "IPHLPAPI.DLL" ascii

      $op1 = { 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68
               69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F
               74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20
               6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 }

      $vprotect = { 2E 76 6D 70 30 }
   condition:
      /* MZ and PE */
      uint16(0) == 0x5a4d and uint32(uint32(0x3c)) == 0x4550 and
      /* Expected file size */
      filesize < 1400KB and filesize > 800KB and (
         /* Imports */
         all of ($s*) and
         /* Specific header - possibly Yoda protector*/
         $op1 at 64 and
         uint16(uint32(0x3c) + 11) == 0x59 and
         /* Vprotect */
         $vprotect in (600..700)
      )
}
YARA Detection Rule: UBoatRAT_Dropper
Repository: Neo23x0/signature-base
Detects: Detects UBoatRAT Dropper
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/

Pattern signatures:
$s1 = "GetCurrenvackageId" fullword ascii
      $s2 = "fghijklmnopq" fullword ascii
      $s3 = "23456789:;<=>?@ABCDEFGHIJKLMNOPQ" fullword ascii
      $s4 = "PMM/dd/y" fullword ascii
      $s5 = "bad all" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and all of them )

Full rule:
rule UBoatRAT_Dropper {
   meta:
      description = "Detects UBoatRAT Dropper"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/"
      date = "2017-11-29"
      hash1 = "f4c659238ffab95e87894d2c556f887774dce2431e8cb87f881df4e4d26253a3"
      id = "f3d4e333-1282-5f6e-9294-628a8230d2a5"
   strings:
      $s1 = "GetCurrenvackageId" fullword ascii
      $s2 = "fghijklmnopq" fullword ascii
      $s3 = "23456789:;<=>?@ABCDEFGHIJKLMNOPQ" fullword ascii
      $s4 = "PMM/dd/y" fullword ascii
      $s5 = "bad all" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
}
YARA Detection Rule: PUA_VULN_Renamed_Driver_Zemanaltd_Zam_D7E0
Repository: Neo23x0/signature-base
Detects: Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0032002e[PII_REDACTED]2e0031002e[PII_REDACTED]30 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e0031002e[PII_REDACTED]30 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /zam64/i and not filename matches /zamguard32/i and not filename matches /zamguard64/i

Full rule:
rule PUA_VULN_Renamed_Driver_Zemanaltd_Zam_D7E0 {
	meta:
		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "d7e091e0d478c34232e8479b950c5513077b3a69309885cee4c61063e5f74ac0"
		date = "2024-08-07"
		score = 70
		id = "6149cb1c-fb85-5895-9f7b-c1852d55bf85"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0032002e[PII_REDACTED]2e0031002e[PII_REDACTED]30 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e0031002e[PII_REDACTED]30 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /zam64/i and not filename matches /zamguard32/i and not filename matches /zamguard64/i
}
YARA Detection Rule: PUA_VULN_Renamed_Driver_Zemanaltd_Zam_8FE9
Repository: Neo23x0/signature-base
Detects: Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e[PII_REDACTED]35 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /zam64/i and not filename matches /zamguard32/i and not filename matches /zamguard64/i

Full rule:
rule PUA_VULN_Renamed_Driver_Zemanaltd_Zam_8FE9 {
	meta:
		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "8fe9828bea83adc8b1429394db7a556a17f79846ad0bfb7f242084a5c96edf2a"
		date = "2024-08-07"
		score = 70
		id = "1f6419e9-6172-58a8-94bc-3357ac5005fc"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e[PII_REDACTED]35 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /zam64/i and not filename matches /zamguard32/i and not filename matches /zamguard64/i
}
YARA Detection Rule: PUA_VULN_Renamed_Driver_Yyinc_Dianhu_80CB
Repository: Neo23x0/signature-base
Detects: Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Dh_Kernel_10.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8][PII_REDACTED]61006e00680075 } /* FileDescription dianhu */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8][PII_REDACTED]200049006e0063002e } /* CompanyName YYInc */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0031002e0030002e00390039 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0031002e0030002e00390039 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8][PII_REDACTED]61006e00680075 } /* ProductName dianhu */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]0043006f[PII_REDACTED][PII_REDACTED][PII_REDACTED]2000a[PII_REDACTED][PII_REDACTED]7002d[PII_REDACTED][PII_REDACTED][PII_REDACTED]200049006e0063002e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright CopyrightYYIncAllrightsreserved */

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /Dh_Kernel_10/i

Full rule:
rule PUA_VULN_Renamed_Driver_Yyinc_Dianhu_80CB {
	meta:
		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Dh_Kernel_10.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "80cbba9f404df3e642f22c476664d63d7c229d45d34f5cd0e19c65eb41becec3"
		hash = "bb50818a07b0eb1bd317467139b7eb4bad6cd89053fecdabfeae[PII_REDACTED]5"
		date = "2024-08-07"
		score = 70
		id = "1675607c-efae-5099-be11-bc206c0712b5"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8][PII_REDACTED]61006e00680075 } /* FileDescription dianhu */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8][PII_REDACTED]200049006e0063002e } /* CompanyName YYInc */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0031002e0030002e00390039 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0031002e0030002e00390039 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8][PII_REDACTED]61006e00680075 } /* ProductName dianhu */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]0043006f[PII_REDACTED][PII_REDACTED][PII_REDACTED]2000a[PII_REDACTED][PII_REDACTED]7002d[PII_REDACTED][PII_REDACTED][PII_REDACTED]200049006e0063002e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright CopyrightYYIncAllrightsreserved */
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /Dh_Kernel_10/i
}
YARA Detection Rule: PUA_VULN_Renamed_Driver_3F20
Repository: Neo23x0/signature-base
Detects: Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - pchunter.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]7cfb7edf4fe1606f67e5770b5de55177 } /* FileDescription  */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]5b8982af7f5176feff0853174eacff0979d[PII_REDACTED]50516c53f8 } /* CompanyName  */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0031002e0030002e0030002e0035 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0031002e0030002e0035002e0037 } /* ProductVersion  */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8][PII_REDACTED][PII_REDACTED][PII_REDACTED]39002d[PII_REDACTED][PII_REDACTED]0041006e[PII_REDACTED]6e[PII_REDACTED][PII_REDACTED]006f[PII_REDACTED]6f[PII_REDACTED]740069006f006e002e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright CAnXinSecCorporationAllRightsReserved */

Detection condition:
uint16(0) == 0x5a4d and filesize < 700KB and all of them and not filename matches /pchunter/i

Full rule:
rule PUA_VULN_Renamed_Driver_3F20 {
	meta:
		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - pchunter.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "3f20ac5dac9171857fc[PII_REDACTED]fdb6eac4fab837d7eabc42cb0a83cb522fc"
		date = "2024-08-07"
		score = 70
		id = "9873e3bb-62e9-5dc8-b44d-6885d72601a8"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]7cfb7edf4fe1606f67e5770b5de55177 } /* FileDescription  */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]5b8982af7f5176feff0853174eacff0979d[PII_REDACTED]50516c53f8 } /* CompanyName  */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0031002e0030002e0030002e0035 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0031002e0030002e0035002e0037 } /* ProductVersion  */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8][PII_REDACTED][PII_REDACTED][PII_REDACTED]39002d[PII_REDACTED][PII_REDACTED]0041006e[PII_REDACTED]6e[PII_REDACTED][PII_REDACTED]006f[PII_REDACTED]6f[PII_REDACTED]740069006f006e002e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright CAnXinSecCorporationAllRightsReserved */
	condition:
		uint16(0) == 0x5a4d and filesize < 700KB and all of them and not filename matches /pchunter/i
}
YARA Detection Rule: PUA_VULN_Renamed_Driver_Dell_Dbutil_71FE
Repository: Neo23x0/signature-base
Detects: Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DBUtilDrv2.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8][PII_REDACTED][PII_REDACTED]006c } /* FileDescription DBUtil */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8][PII_REDACTED]6c006c } /* CompanyName Dell */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e0037002e0030002e0030 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8][PII_REDACTED][PII_REDACTED]006c } /* ProductName DBUtil */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]00a[PII_REDACTED][PII_REDACTED][PII_REDACTED]65006c006c[PII_REDACTED]6e0063002e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e0020 } /* LegalCopyright DellIncAllRightsReserved */

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /DBUtilDrv2/i

Full rule:
rule PUA_VULN_Renamed_Driver_Dell_Dbutil_71FE {
	meta:
		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DBUtilDrv2.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009"
		date = "2024-08-07"
		score = 70
		id = "ee5c03fc-8778-57ef-b300-2009bbf9208f"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8][PII_REDACTED][PII_REDACTED]006c } /* FileDescription DBUtil */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8][PII_REDACTED]6c006c } /* CompanyName Dell */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e0037002e0030002e0030 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8][PII_REDACTED][PII_REDACTED]006c } /* ProductName DBUtil */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]00a[PII_REDACTED][PII_REDACTED][PII_REDACTED]65006c006c[PII_REDACTED]6e0063002e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e0020 } /* LegalCopyright DellIncAllRightsReserved */
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /DBUtilDrv2/i
}