deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: CN_Hacktool_ScanPort_Portscanner
Repository: Neo23x0/signature-base
Detects: Detects a chinese Portscanner named ScanPort
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "LScanPort" fullword wide
      $s1 = "LScanPort Microsoft" fullword wide
      $s2 = "www.yupsoft.com" fullword wide

Detection condition:
all of them

Full rule:
rule CN_Hacktool_ScanPort_Portscanner {
   meta:
      description = "Detects a chinese Portscanner named ScanPort"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      score = 70
      date = "12.10.2014"
      id = "a708283e-339c-599f-9321-3b063d0076a9"
   strings:
      $s0 = "LScanPort" fullword wide
      $s1 = "LScanPort Microsoft" fullword wide
      $s2 = "www.yupsoft.com" fullword wide
   condition:
      all of them
}
YARA Detection Rule: CN_Hacktool_S_EXE_Portscanner
Repository: Neo23x0/signature-base
Detects: Detects a chinese Portscanner named s.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "\\Result.txt" ascii
      $s1 = "By:ZT QQ:376789051" fullword ascii
      $s2 = "(http://www.eyuyan.com)" fullword wide

Detection condition:
all of them

Full rule:
rule CN_Hacktool_S_EXE_Portscanner {
   meta:
      description = "Detects a chinese Portscanner named s.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      score = 70
      date = "12.10.2014"
      id = "d6b35d4f-7e25-50dd-bef2-08f7033312e8"
   strings:
      $s0 = "\\Result.txt" ascii
      $s1 = "By:ZT QQ:376789051" fullword ascii
      $s2 = "(http://www.eyuyan.com)" fullword wide
   condition:
      all of them
}
YARA Detection Rule: CN_Hacktool_MilkT_BAT
Repository: Neo23x0/signature-base
Detects: Detects a chinese Portscanner named MilkT - shipped BAT
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" ascii
      $s1 = "if not \"%Choice%\"==\"\" set Choice=%Choice:~0,1%" ascii

Detection condition:
all of them

Full rule:
rule CN_Hacktool_MilkT_BAT {
   meta:
      description = "Detects a chinese Portscanner named MilkT - shipped BAT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      score = 70
      date = "12.10.2014"
      id = "d680a5f1-6182-5bc8-99de-c3cba1a61903"
   strings:
      $s0 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" ascii
      $s1 = "if not \"%Choice%\"==\"\" set Choice=%Choice:~0,1%" ascii
   condition:
      all of them
}
YARA Detection Rule: CN_Hacktool_MilkT_Scanner
Repository: Neo23x0/signature-base
Detects: Detects a chinese Portscanner named MilkT
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Bf **************" ascii fullword
      $s1 = "forming Time: %d/" ascii
      $s2 = "KERNEL32.DLL" ascii fullword
      $s3 = "CRTDLL.DLL" ascii fullword
      $s4 = "WS2_32.DLL" ascii fullword
      $s5 = "GetProcAddress" ascii fullword
      $s6 = "atoi" ascii fullword

Detection condition:
all of them

Full rule:
rule CN_Hacktool_MilkT_Scanner {
   meta:
      description = "Detects a chinese Portscanner named MilkT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      score = 60
      date = "12.10.2014"
      id = "aa83c983-25c2-5051-88a1-fbc70d947d6e"
   strings:
      $s0 = "Bf **************" ascii fullword
      $s1 = "forming Time: %d/" ascii
      $s2 = "KERNEL32.DLL" ascii fullword
      $s3 = "CRTDLL.DLL" ascii fullword
      $s4 = "WS2_32.DLL" ascii fullword
      $s5 = "GetProcAddress" ascii fullword
      $s6 = "atoi" ascii fullword
   condition:
      all of them
}
YARA Detection Rule: CN_Hacktool_1433_Scanner
Repository: Neo23x0/signature-base
Detects: Detects a chinese MSSQL scanner
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "1433" wide fullword
      $s1 = "1433V" wide
      $s2 = "del Weak1.txt" ascii fullword
      $s3 = "del Attack.txt" ascii fullword
      $s4 = "del /s /Q C:\\Windows\\system32\\doors\\" ascii
      $s5 = "!&start iexplore http://www.crsky.com/soft/4818.html)" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and all of ($s*)

Full rule:
rule CN_Hacktool_1433_Scanner {
   meta:
      description = "Detects a chinese MSSQL scanner"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      score = 40
      date = "12.10.2014"
      id = "77712d29-1a32-59e7-999a-a2ef02212886"
   strings:
      $s0 = "1433" wide fullword
      $s1 = "1433V" wide
      $s2 = "del Weak1.txt" ascii fullword
      $s3 = "del Attack.txt" ascii fullword
      $s4 = "del /s /Q C:\\Windows\\system32\\doors\\" ascii
      $s5 = "!&start iexplore http://www.crsky.com/soft/4818.html)" fullword ascii
   condition:
      uint16(0) == 0x5a4d and all of ($s*)
}
YARA Detection Rule: CN_Hacktool_1433_Scanner_Comp2
Repository: Neo23x0/signature-base
Detects: Detects a chinese MSSQL scanner - component 2
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "1433" wide fullword
      $s1 = "1433V" wide
      $s2 = "UUUMUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUMUUU" ascii fullword

Detection condition:
uint16(0) == 0x5a4d and all of ($s*)

Full rule:
rule CN_Hacktool_1433_Scanner_Comp2 {
   meta:
      description = "Detects a chinese MSSQL scanner - component 2"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      score = 40
      date = "12.10.2014"
      id = "7d707be5-dad0-5d91-965b-908a8603b6c0"
   strings:
      $s0 = "1433" wide fullword
      $s1 = "1433V" wide
      $s2 = "UUUMUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUMUUU" ascii fullword
   condition:
      uint16(0) == 0x5a4d and all of ($s*)
}
YARA Detection Rule: WCE_Modified_1_1014
Repository: Neo23x0/signature-base
Detects: Modified (packed) version of Windows Credential Editor
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "LSASS.EXE" fullword ascii
      $s1 = "_CREDS" ascii
      $s9 = "Using WCE " ascii

Detection condition:
all of them

Full rule:
rule WCE_Modified_1_1014 {
   meta:
      description = "Modified (packed) version of Windows Credential Editor"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      hash = "09a412ac3c85cedce2642a19e99d8f903a2e0354"
      score = 70
      id = "536d1a7f-bda1-5c22-bf72-a177468e7c42"
   strings:
      $s0 = "LSASS.EXE" fullword ascii
      $s1 = "_CREDS" ascii
      $s9 = "Using WCE " ascii
   condition:
      all of them
}
YARA Detection Rule: ReactOS_cmd_valid
Repository: Neo23x0/signature-base
Detects: ReactOS cmd.exe with correct file name - maybe packed with software or part of hacker toolset
Author: Florian Roth (Nextron Systems)
Reference: http://www.elifulkerson.com/articles/suzy-sells-cmd-shells.php

Pattern signatures:
$s1 = "ReactOS Command Processor" fullword wide
      $s2 = "Copyright (C) 1994-1998 Tim Norman and others" fullword wide
      $s3 = "Eric Kohl and others" fullword wide
      $s4 = "ReactOS Operating System" fullword wide

Detection condition:
all of ($s*)

Full rule:
rule ReactOS_cmd_valid {
   meta:
      description = "ReactOS cmd.exe with correct file name - maybe packed with software or part of hacker toolset"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "05.11.14"
      reference = "http://www.elifulkerson.com/articles/suzy-sells-cmd-shells.php"
      score = 30
      hash = "b88f050fa69d85af3ff99af90a157435296cbb6e"
      id = "47df12b4-d202-5520-9c7f-9d0196bc2267"
   strings:
      $s1 = "ReactOS Command Processor" fullword wide
      $s2 = "Copyright (C) 1994-1998 Tim Norman and others" fullword wide
      $s3 = "Eric Kohl and others" fullword wide
      $s4 = "ReactOS Operating System" fullword wide
   condition:
      all of ($s*)
}
YARA Detection Rule: iKAT_wmi_rundll
Repository: Neo23x0/signature-base
Detects: This exe will attempt to use WMI to Call the Win32_Process event to spawn rundll - file wmi_rundll.exe
Author: Florian Roth (Nextron Systems)
Reference: http://ikat.ha.cked.net/Windows/functions/ikatfiles.html

Pattern signatures:
$s0 = "This operating system is not supported." fullword ascii
      $s1 = "Error!" fullword ascii
      $s2 = "Win32 only!" fullword ascii
      $s3 = "COMCTL32.dll" fullword ascii
      $s4 = "[LordPE]" ascii
      $s5 = "CRTDLL.dll" fullword ascii
      $s6 = "VBScript" fullword ascii
      $s7 = "CoUninitialize" fullword ascii

Detection condition:
all of them and filesize < 15KB

Full rule:
rule iKAT_wmi_rundll {
   meta:
      description = "This exe will attempt to use WMI to Call the Win32_Process event to spawn rundll - file wmi_rundll.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "05.11.14"
      score = 65
      reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
      hash = "97c4d4e6a644eed5aa12437805e39213e494d120"
      id = "e3d80c95-d333-53cf-8165-b3a1e66ed00d"
   strings:
      $s0 = "This operating system is not supported." fullword ascii
      $s1 = "Error!" fullword ascii
      $s2 = "Win32 only!" fullword ascii
      $s3 = "COMCTL32.dll" fullword ascii
      $s4 = "[LordPE]" ascii
      $s5 = "CRTDLL.dll" fullword ascii
      $s6 = "VBScript" fullword ascii
      $s7 = "CoUninitialize" fullword ascii
   condition:
      all of them and filesize < 15KB
}
YARA Detection Rule: iKAT_revelations
Repository: Neo23x0/signature-base
Detects: iKAT hack tool showing the content of password fields - file revelations.exe
Author: Florian Roth (Nextron Systems)
Reference: http://ikat.ha.cked.net/Windows/functions/ikatfiles.html

Pattern signatures:
$s0 = "The RevelationHelper.DLL file is corrupt or missing." fullword ascii
      $s8 = "BETAsupport@snadboy.com" fullword wide
      $s9 = "support@snadboy.com" fullword wide
      $s14 = "RevelationHelper.dll" fullword ascii

Detection condition:
all of them

Full rule:
rule iKAT_revelations {
   meta:
      description = "iKAT hack tool showing the content of password fields - file revelations.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "05.11.14"
      score = 75
      reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
      hash = "c4e217a8f2a[PII_REDACTED]561c5926cbd522f7996"
      id = "c5ef2c2a-c9c0-5c3a-bbcc-0b[PII_REDACTED]"
   strings:
      $s0 = "The RevelationHelper.DLL file is corrupt or missing." fullword ascii
      $s8 = "BETAsupport@snadboy.com" fullword wide
      $s9 = "support@snadboy.com" fullword wide
      $s14 = "RevelationHelper.dll" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: iKAT_priv_esc_tasksch
Repository: Neo23x0/signature-base
Detects: Task Schedulder Local Exploit - Windows local priv-esc using Task Scheduler, published by webDevil. Supports Windows 7 and Vista.
Author: Florian Roth (Nextron Systems)
Reference: http://ikat.ha.cked.net/Windows/functions/ikatfiles.html

Pattern signatures:
$s0 = "objShell.Run \"schtasks /change /TN wDw00t /disable\",,True" fullword ascii
      $s3 = "objShell.Run \"schtasks /run /TN wDw00t\",,True" fullword ascii
      $s4 = "'objShell.Run \"cmd /c copy C:\\windows\\system32\\tasks\\wDw00t .\",,True" fullword ascii
      $s6 = "a.WriteLine (\"schtasks /delete /f /TN wDw00t\")" fullword ascii
      $s7 = "a.WriteLine (\"net user /add ikat ikat\")" fullword ascii
      $s8 = "a.WriteLine (\"cmd.exe\")" fullword ascii
      $s9 = "strFileName=\"C:\\windows\\system32\\tasks\\wDw00t\"" fullword ascii
      $s10 = "For n = 1 To (Len (hexXML) - 1) step 2" fullword ascii
      $s13 = "output.writeline \" Should work on Vista/Win7/2008 x86/x64\"" fullword ascii
      $s11 = "Set objExecObject = objShell.Exec(\"cmd /c schtasks /query /XML /TN wDw00t\")" fullword ascii
      $s12 = "objShell.Run \"schtasks /create /TN wDw00t /sc monthly /tr \"\"\"+biatchFile+\"" ascii
      $s14 = "a.WriteLine (\"net localgroup administrators /add v4l\")" fullword 

Detection condition:
2 of them

Full rule:
rule iKAT_priv_esc_tasksch {
   meta:
      description = "Task Schedulder Local Exploit - Windows local priv-esc using Task Scheduler, published by webDevil. Supports Windows 7 and Vista."
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "05.11.14"
      score = 75
      reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
      hash = "84ab94bff7abf10ffe4446ff280f071f9702cf8b"
      id = "0786b313-3154-536b-b7eb-c4d8444a309f"
   strings:
      $s0 = "objShell.Run \"schtasks /change /TN wDw00t /disable\",,True" fullword ascii
      $s3 = "objShell.Run \"schtasks /run /TN wDw00t\",,True" fullword ascii
      $s4 = "'objShell.Run \"cmd /c copy C:\\windows\\system32\\tasks\\wDw00t .\",,True" fullword ascii
      $s6 = "a.WriteLine (\"schtasks /delete /f /TN wDw00t\")" fullword ascii
      $s7 = "a.WriteLine (\"net user /add ikat ikat\")" fullword ascii
      $s8 = "a.WriteLine (\"cmd.exe\")" fullword ascii
      $s9 = "strFileName=\"C:\\windows\\system32\\tasks\\wDw00t\"" fullword ascii
      $s10 = "For n = 1 To (Len (hexXML) - 1) step 2" fullword ascii
      $s13 = "output.writeline \" Should work on Vista/Win7/2008 x86/x64\"" fullword ascii
      $s11 = "Set objExecObject = objShell.Exec(\"cmd /c schtasks /query /XML /TN wDw00t\")" fullword ascii
      $s12 = "objShell.Run \"schtasks /create /TN wDw00t /sc monthly /tr \"\"\"+biatchFile+\"" ascii
      $s14 = "a.WriteLine (\"net localgroup administrators /add v4l\")" fullword ascii
      $s20 = "Set ts = fso.createtextfile (\"wDw00t.xml\")" fullword ascii
   condition:
      2 of them
}
YARA Detection Rule: iKAT_command_lines_agent
Repository: Neo23x0/signature-base
Detects: iKAT hack tools set agent - file ikat.exe
Author: Florian Roth (Nextron Systems)
Reference: http://ikat.ha.cked.net/Windows/functions/ikatfiles.html

Pattern signatures:
$s0 = "Extended Module: super mario brothers" fullword ascii
      $s1 = "Extended Module: " fullword ascii
      $s3 = "ofpurenostalgicfeeling" fullword ascii
      $s8 = "-supermariobrotheretic" fullword ascii
      $s9 = "!http://132.147.96.202:80" fullword ascii
      $s12 = "iKAT Exe Template" fullword ascii
      $s15 = "withadancyflavour.." fullword ascii
      $s16 = "FastTracker v2.00   " fullword ascii

Detection condition:
4 of them

Full rule:
rule iKAT_command_lines_agent {
   meta:
      description = "iKAT hack tools set agent - file ikat.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "05.11.14"
      score = 75
      reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
      hash = "c802ee1e49c0eae2a3fc22d2e82589d857f96d94"
      id = "35068d59-272d-55a6-b211-2c138276914c"
   strings:
      $s0 = "Extended Module: super mario brothers" fullword ascii
      $s1 = "Extended Module: " fullword ascii
      $s3 = "ofpurenostalgicfeeling" fullword ascii
      $s8 = "-supermariobrotheretic" fullword ascii
      $s9 = "!http://132.147.96.202:80" fullword ascii
      $s12 = "iKAT Exe Template" fullword ascii
      $s15 = "withadancyflavour.." fullword ascii
      $s16 = "FastTracker v2.00   " fullword ascii
   condition:
      4 of them
}
YARA Detection Rule: iKAT_cmd_as_dll
Repository: Neo23x0/signature-base
Detects: iKAT toolset file cmd.dll ReactOS file cloaked
Author: Florian Roth (Nextron Systems)
Reference: http://ikat.ha.cked.net/Windows/functions/ikatfiles.html

Pattern signatures:
$s1 = "cmd.exe" fullword wide
      $s2 = "ReactOS Development Team" fullword wide
      $s3 = "ReactOS Command Processor" fullword wide

      $ext = "extension: .dll" nocase

Detection condition:
all of ($s*) and $ext

Full rule:
rule iKAT_cmd_as_dll {
   meta:
      description = "iKAT toolset file cmd.dll ReactOS file cloaked"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "05.11.14"
      score = 65
      reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
      hash = "b5d0ba941efbc3b5c97fe70f70c14b2050b8336a"
      id = "8d15b4b6-25f3-556c-bfa8-eba503c9c649"
   strings:
      $s1 = "cmd.exe" fullword wide
      $s2 = "ReactOS Development Team" fullword wide
      $s3 = "ReactOS Command Processor" fullword wide

      $ext = "extension: .dll" nocase
   condition:
      all of ($s*) and $ext
}
YARA Detection Rule: iKAT_tools_nmap
Repository: Neo23x0/signature-base
Detects: Generic rule for NMAP - based on NMAP 4 standalone
Author: Florian Roth (Nextron Systems)
Reference: http://ikat.ha.cked.net/Windows/functions/ikatfiles.html

Pattern signatures:
$s0 = "Insecure.Org" fullword wide
      $s1 = "Copyright (c) Insecure.Com" fullword wide
      $s2 = "nmap" fullword nocase
      $s3 = "Are you alert enough to be using Nmap?  Have some coffee or Jolt(tm)." ascii

Detection condition:
all of them

Full rule:
rule iKAT_tools_nmap {
   meta:
      description = "Generic rule for NMAP - based on NMAP 4 standalone"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "05.11.14"
      score = 50
      reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
      hash = "d0543f365df61e6ebb5e345943577cc40fca8682"
      id = "be4858e6-a8f3-55eb-9c04-f4def838dde1"
   strings:
      $s0 = "Insecure.Org" fullword wide
      $s1 = "Copyright (c) Insecure.Com" fullword wide
      $s2 = "nmap" fullword nocase
      $s3 = "Are you alert enough to be using Nmap?  Have some coffee or Jolt(tm)." ascii
   condition:
      all of them
}
YARA Detection Rule: iKAT_startbar
Repository: Neo23x0/signature-base
Detects: Tool to hide unhide the windows startbar from command line - iKAT hack tools - file startbar.exe
Author: Florian Roth (Nextron Systems)
Reference: http://ikat.ha.cked.net/Windows/functions/ikatfiles.html

Pattern signatures:
$s2 = "Shinysoft Limited1" fullword ascii
      $s3 = "Shinysoft Limited0" fullword ascii
      $s4 = "Wellington1" fullword ascii
      $s6 = "Wainuiomata1" fullword ascii
      $s8 = "56 Wright St1" fullword ascii
      $s9 = "UTN-USERFirst-Object" fullword ascii
      $s10 = "New Zealand1" fullword ascii

Detection condition:
all of them

Full rule:
rule iKAT_startbar {
   meta:
      description = "Tool to hide unhide the windows startbar from command line - iKAT hack tools - file startbar.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "05.11.14"
      score = 50
      reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
      hash = "0cac59b80b5427a8780168e1b85c540efffaf74f"
      id = "f29f15e9-aa29-519a-b4ad-c018aac68fd6"
   strings:
      $s2 = "Shinysoft Limited1" fullword ascii
      $s3 = "Shinysoft Limited0" fullword ascii
      $s4 = "Wellington1" fullword ascii
      $s6 = "Wainuiomata1" fullword ascii
      $s8 = "56 Wright St1" fullword ascii
      $s9 = "UTN-USERFirst-Object" fullword ascii
      $s10 = "New Zealand1" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: iKAT_Tool_Generic
Repository: Neo23x0/signature-base
Detects: Generic Rule for hack tool iKAT files gpdisable.exe, kitrap0d.exe, uacpoc.exe
Author: Florian Roth (Nextron Systems)
Reference: http://ikat.ha.cked.net/Windows/functions/ikatfiles.html

Pattern signatures:
$s0 = "<IconFile>C:\\WINDOWS\\App.ico</IconFile>" fullword
      $s1 = "Failed to read the entire file" fullword
      $s4 = "<VersionCreatedBy>14.4.0</VersionCreatedBy>" fullword
      $s8 = "<ProgressCaption>Run &quot;executor.bat&quot; once the shell has spawned.</P"
      $s9 = "Running Zip pipeline..." fullword
      $s10 = "<FinTitle />" fullword
      $s12 = "<AutoTemp>0</AutoTemp>" fullword
      $s14 = "<DefaultDir>%TEMP%</DefaultDir>" fullword
      $s15 = "AES Encrypting..." fullword
      $s20 = "<UnzipDir>%TEMP%</UnzipDir>" fullword

Detection condition:
all of them

Full rule:
rule iKAT_Tool_Generic {
   meta:
      description = "Generic Rule for hack tool iKAT files gpdisable.exe, kitrap0d.exe, uacpoc.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "05.11.14"
      score = 55
      reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
      super_rule = 1
      hash0 = "814c126f21bc5e993499f0c4e15b280bf7c1c77f"
      hash1 = "75f5aed1e719443a710b70f2004f34b2fe30f2a9"
      hash2 = "b65a460d015fd94830d55e8eeaf6222321e12349"
      id = "a8064a26-09c0-59f1-bdf9-628a445014ff"
   strings:
      $s0 = "<IconFile>C:\\WINDOWS\\App.ico</IconFile>" fullword
      $s1 = "Failed to read the entire file" fullword
      $s4 = "<VersionCreatedBy>14.4.0</VersionCreatedBy>" fullword
      $s8 = "<ProgressCaption>Run &quot;executor.bat&quot; once the shell has spawned.</P"
      $s9 = "Running Zip pipeline..." fullword
      $s10 = "<FinTitle />" fullword
      $s12 = "<AutoTemp>0</AutoTemp>" fullword
      $s14 = "<DefaultDir>%TEMP%</DefaultDir>" fullword
      $s15 = "AES Encrypting..." fullword
      $s20 = "<UnzipDir>%TEMP%</UnzipDir>" fullword
   condition:
      all of them
}
YARA Detection Rule: BypassUac2
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file BypassUac2.zip
Author: yarGen Yara Rule Generator

Pattern signatures:
$s0 = "/BypassUac/BypassUac/BypassUac_Utils.cpp" fullword ascii
      $s1 = "/BypassUac/BypassUacDll/BypassUacDll.aps" fullword ascii
      $s3 = "/BypassUac/BypassUac/BypassUac.ico" fullword ascii

Detection condition:
all of them

Full rule:
rule BypassUac2 {
   meta:
      description = "Auto-generated rule - file BypassUac2.zip"
      author = "yarGen Yara Rule Generator"
      hash = "ef3e7dd2d1384ecec1a[PII_REDACTED]9a43695df61"
      id = "8b7e49de-9b0a-5dc4-86af-1a854dc649cc"
   strings:
      $s0 = "/BypassUac/BypassUac/BypassUac_Utils.cpp" fullword ascii
      $s1 = "/BypassUac/BypassUacDll/BypassUacDll.aps" fullword ascii
      $s3 = "/BypassUac/BypassUac/BypassUac.ico" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: BypassUac_3
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file BypassUacDll.dll
Author: yarGen Yara Rule Generator

Pattern signatures:
$s0 = "BypassUacDLL.dll" fullword wide
      $s1 = "\\Release\\BypassUacDll" ascii
      $s3 = "Win7ElevateDLL" fullword wide
      $s7 = "BypassUacDLL" fullword wide

Detection condition:
3 of them

Full rule:
rule BypassUac_3 {
   meta:
      description = "Auto-generated rule - file BypassUacDll.dll"
      author = "yarGen Yara Rule Generator"
      hash = "1974aacd0ed[PII_REDACTED]35cad[PII_REDACTED]ce35"
      id = "407a8e12-1160-584d-94c8-7aa78e29c754"
   strings:
      $s0 = "BypassUacDLL.dll" fullword wide
      $s1 = "\\Release\\BypassUacDll" ascii
      $s3 = "Win7ElevateDLL" fullword wide
      $s7 = "BypassUacDLL" fullword wide
   condition:
      3 of them
}