deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: CN_Honker_HASH_PwDump7
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file PwDump7.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "%s\\SYSTEM32\\CONFIG\\SAM" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "No Users key!" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "NO PASSWORD*********************:" fullword ascii /* PEStudio Blacklist: strings */
		$s4 = "Unable to dump file %S" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 380KB and all of them

Full rule:
rule CN_Honker_HASH_PwDump7 {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file PwDump7.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "93a2d7c3a9b83371d96a575c15fe6fce6f9d50d3"
		id = "d61a1ac3-7c8a-5de2-a5a8-2a043b73f3b3"
	strings:
		$s1 = "%s\\SYSTEM32\\CONFIG\\SAM" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "No Users key!" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "NO PASSWORD*********************:" fullword ascii /* PEStudio Blacklist: strings */
		$s4 = "Unable to dump file %S" fullword ascii /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 380KB and all of them
}
YARA Detection Rule: CN_Honker_ChinaChopper
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file ChinaChopper.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "$m=get_magic_quotes_gpc();$sid=$m?stripslashes($_POST[\"z1\"]):$_POST[\"z1\"];$u" wide /* PEStudio Blacklist: strings */
		$s3 = "SETP c:\\windows\\system32\\cmd.exe " fullword wide /* PEStudio Blacklist: strings */
		$s4 = "Ev al (\"Exe cute(\"\"On+Error+Resume+Next:%s:Response.Write(\"\"\"\"->|\"\"\"\"" wide /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them

Full rule:
rule CN_Honker_ChinaChopper {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file ChinaChopper.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "fa347fdb23ab0b8d0560a0d20c434549d78e99b5"
		id = "9f7fbaac-65b5-5162-87d1-96ccd9711adb"
	strings:
		$s1 = "$m=get_magic_quotes_gpc();$sid=$m?stripslashes($_POST[\"z1\"]):$_POST[\"z1\"];$u" wide /* PEStudio Blacklist: strings */
		$s3 = "SETP c:\\windows\\system32\\cmd.exe " fullword wide /* PEStudio Blacklist: strings */
		$s4 = "Ev al (\"Exe cute(\"\"On+Error+Resume+Next:%s:Response.Write(\"\"\"\"->|\"\"\"\"" wide /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them
}
YARA Detection Rule: CN_Honker_dedecms5_7
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file dedecms5.7.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "/data/admin/ver.txt" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "SkinH_EL.dll" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 830KB and all of them

Full rule:
rule CN_Honker_dedecms5_7 {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file dedecms5.7.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f9cbb25883828ca266e32ff4faf62f5a9f92c5fb"
		id = "b037862d-2821-5e96-996b-13ab241575ba"
	strings:
		$s1 = "/data/admin/ver.txt" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "SkinH_EL.dll" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 830KB and all of them
}
YARA Detection Rule: CN_Honker_Alien_ee
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file ee.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "GetIIS UserName and PassWord." fullword wide /* PEStudio Blacklist: strings */
		$s2 = "Read IIS ID For FreeHost." fullword wide /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 50KB and all of them

Full rule:
rule CN_Honker_Alien_ee {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file ee.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "15a7211154ee7aca29529bd5c2500e0d33d7f0b3"
		id = "03540f82-6662-55e3-97f8-38776271f08b"
	strings:
		$s1 = "GetIIS UserName and PassWord." fullword wide /* PEStudio Blacklist: strings */
		$s2 = "Read IIS ID For FreeHost." fullword wide /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 50KB and all of them
}
YARA Detection Rule: CN_Honker_smsniff_smsniff
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file smsniff.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "smsniff.exe" fullword wide
		$s5 = "SmartSniff" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 267KB and all of them

Full rule:
rule CN_Honker_smsniff_smsniff {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file smsniff.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "8667a785a8ced76d0284d225be230b5f1546f140"
		id = "fef242d5-b274-5217-a5d1-1a6ec38d0fdd"
	strings:
		$s1 = "smsniff.exe" fullword wide
		$s5 = "SmartSniff" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 267KB and all of them
}
YARA Detection Rule: CN_Honker_Happy_Happy
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file Happy.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "<form.*?method=\"post\"[\\s\\S]*?</form>" fullword wide /* PEStudio Blacklist: strings */
		$s2 = "domainscan.exe" fullword wide /* PEStudio Blacklist: strings */
		$s3 = "http://www.happysec.com/" wide
		$s4 = "cmdshell" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 655KB and 2 of them

Full rule:
rule CN_Honker_Happy_Happy {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Happy.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		modified = "2023-01-27"
		score = 70
		hash = "92067d8dad33177b5d6c853d4d0e897f2ee846b0"
		id = "6e6c806d-e784-507f-b327-3b9f2510422b"
	strings:
		$s1 = "<form.*?method=\"post\"[\\s\\S]*?</form>" fullword wide /* PEStudio Blacklist: strings */
		$s2 = "domainscan.exe" fullword wide /* PEStudio Blacklist: strings */
		$s3 = "http://www.happysec.com/" wide
		$s4 = "cmdshell" fullword ascii /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 655KB and 2 of them
}
YARA Detection Rule: CN_Honker_T00ls_Lpk_Sethc_v3_0
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file T00ls Lpk Sethc v3.0.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "http://127.0.0.1/1.exe" fullword wide /* PEStudio Blacklist: strings */
		$s2 = ":Rices  Forum:T00Ls.Net  [4 Fucker Te@m]" fullword wide
		$s3 = "SkinH_EL.dll" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them

Full rule:
rule CN_Honker_T00ls_Lpk_Sethc_v3_0 {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file T00ls Lpk Sethc v3.0.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "fa47c4affbac01ba5606c4862fdb77233c1ef656"
		id = "7513a513-e8a3-58a8-8dd5-512ba33ff013"
	strings:
		$s1 = "http://127.0.0.1/1.exe" fullword wide /* PEStudio Blacklist: strings */
		$s2 = ":Rices  Forum:T00Ls.Net  [4 Fucker Te@m]" fullword wide
		$s3 = "SkinH_EL.dll" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them
}
YARA Detection Rule: CN_Honker_NetFuke_NetFuke
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file NetFuke.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "Mac Flood: Flooding %dT %d p/s " fullword ascii
		$s2 = "netfuke_%s.txt" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1840KB and all of them

Full rule:
rule CN_Honker_NetFuke_NetFuke {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file NetFuke.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f89e223fd4f6f5a3c2a2ea225660ef0957fc07ba"
		id = "833da5c7-e562-50e9-a2a9-54c36b0d1f61"
	strings:
		$s1 = "Mac Flood: Flooding %dT %d p/s " fullword ascii
		$s2 = "netfuke_%s.txt" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 1840KB and all of them
}
YARA Detection Rule: CN_Honker_ManualInjection
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file ManualInjection.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s0 = "http://127.0.0.1/cookie.asp?fuck=" fullword ascii /* PEStudio Blacklist: strings */
		$s16 = "http://Www.cnhuker.com | http://www.0855.tv" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 3000KB and all of them

Full rule:
rule CN_Honker_ManualInjection {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file ManualInjection.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "e83d427f44783088a84e9c231c6816c214434526"
		id = "f0899003-824f-56ed-b653-9f7a77b9ec6a"
	strings:
		$s0 = "http://127.0.0.1/cookie.asp?fuck=" fullword ascii /* PEStudio Blacklist: strings */
		$s16 = "http://Www.cnhuker.com | http://www.0855.tv" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
}
YARA Detection Rule: CN_Honker_CnCerT_CCdoor_CMD
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file CnCerT.CCdoor.CMD.dll
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s2 = "CnCerT.CCdoor.CMD.dll" fullword wide
		$s3 = "cmdpath" fullword ascii
		$s4 = "Get4Bytes" fullword ascii
		$s5 = "ExcuteCmd" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 22KB and all of them

Full rule:
rule CN_Honker_CnCerT_CCdoor_CMD {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file CnCerT.CCdoor.CMD.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "1c6ed7d817fa8e6534a5fd36a94f4fc2f066c9cd"
		id = "ddd328a8-7ad8-5b26-9deb-3e5da801cd1b"
	strings:
		$s2 = "CnCerT.CCdoor.CMD.dll" fullword wide
		$s3 = "cmdpath" fullword ascii
		$s4 = "Get4Bytes" fullword ascii
		$s5 = "ExcuteCmd" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 22KB and all of them
}
YARA Detection Rule: CN_Honker_termsrvhack
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file termsrvhack.dll
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "The terminal server cannot issue a client license.  It was unable to issue the" wide /* PEStudio Blacklist: strings */
		$s6 = "%s\\%s\\%d\\%d" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 1052KB and all of them

Full rule:
rule CN_Honker_termsrvhack {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file termsrvhack.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "1c456520a7b7faf71900c[PII_REDACTED]5f5a7d312"
		id = "4fd582a1-3c6d-57a1-bba0-f775bb61ef00"
	strings:
		$s1 = "The terminal server cannot issue a client license.  It was unable to issue the" wide /* PEStudio Blacklist: strings */
		$s6 = "%s\\%s\\%d\\%d" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 1052KB and all of them
}
YARA Detection Rule: CN_Honker_IIS6_iis6
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file iis6.com
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s0 = "GetMod;ul" fullword ascii
		$s1 = "excjpb" fullword ascii
		$s2 = "LEAUT1" fullword ascii
		$s3 = "EnumProcessModules" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 410 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 50KB and all of them

Full rule:
rule CN_Honker_IIS6_iis6 {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file iis6.com"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f0c9106d6d2eea686fd96622986b641968d0b864"
		id = "f5d49cbd-1aec-5126-ab5d-83e485fa6869"
	strings:
		$s0 = "GetMod;ul" fullword ascii
		$s1 = "excjpb" fullword ascii
		$s2 = "LEAUT1" fullword ascii
		$s3 = "EnumProcessModules" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 410 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 50KB and all of them
}
YARA Detection Rule: CN_Honker_struts2_catbox
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file catbox.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s6 = "'Toolmao box by gainover www.toolmao.com" fullword ascii
		$s20 = "{external.exeScript(_toolmao_bgscript[i],'javascript',false);}}" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 8160KB and all of them

Full rule:
rule CN_Honker_struts2_catbox {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file catbox.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "ee8fbd91477e056aef34fce3ade474cafa1a4304"
		id = "24df7a11-5ec4-5e7b-86f6-6195ca01b8f9"
	strings:
		$s6 = "'Toolmao box by gainover www.toolmao.com" fullword ascii
		$s20 = "{external.exeScript(_toolmao_bgscript[i],'javascript',false);}}" fullword ascii /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 8160KB and all of them
}
YARA Detection Rule: CN_Honker_getlsasrvaddr
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file getlsasrvaddr.exe - WCE Amplia Security
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s8 = "pingme.txt" fullword ascii /* PEStudio Blacklist: strings */
		$s16 = ".\\lsasrv.pdb" ascii
		$s20 = "Addresses Found: " fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and all of them

Full rule:
rule CN_Honker_getlsasrvaddr {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file getlsasrvaddr.exe - WCE Amplia Security"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		modified = "2022-12-21"
		score = 70
		hash = "a897d5da98dae8d80f3c0a0ef6a07c4b42fb89ce"
		id = "fa0c0376-c5c3-5b48-b03e-86cefb547479"
	strings:
		$s8 = "pingme.txt" fullword ascii /* PEStudio Blacklist: strings */
		$s16 = ".\\lsasrv.pdb" ascii
		$s20 = "Addresses Found: " fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and all of them
}
YARA Detection Rule: CN_Honker_ms10048_x64
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file ms10048-x64.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "[ ] Creating evil window" fullword ascii
		$s2 = "[+] Set to %d exploit half succeeded" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 125KB and all of them

Full rule:
rule CN_Honker_ms10048_x64 {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file ms10048-x64.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "418bec3493c85e3490e400ecaff5a7760c17a0d0"
		id = "b65b0bad-d74c-5e7a-a613-69ef80585c23"
	strings:
		$s1 = "[ ] Creating evil window" fullword ascii
		$s2 = "[+] Set to %d exploit half succeeded" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 125KB and all of them
}
YARA Detection Rule: CN_Honker_LogCleaner
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file LogCleaner.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s3 = ".exe <ip> [(path]" fullword ascii
		$s4 = "LogCleaner v" ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 250KB and all of them

Full rule:
rule CN_Honker_LogCleaner {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file LogCleaner.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "ab77ed5804b0394d58717c5f844d9c0da5a9f03e"
		id = "63ec5e47-9f3e-547a-bbff-cac8b27ac8f7"
	strings:
		$s3 = ".exe <ip> [(path]" fullword ascii
		$s4 = "LogCleaner v" ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 250KB and all of them
}
YARA Detection Rule: CN_Honker_shell_brute_tool
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file shell_brute_tool.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s0 = "http://24hack.com/xyadmin.asp" fullword ascii /* PEStudio Blacklist: strings */
		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii /* PEStudio Blacklist: agent */

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and all of them

Full rule:
rule CN_Honker_shell_brute_tool {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file shell_brute_tool.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f6903a15453698c35dce841e4d09c542f9480f01"
		id = "80fd0c9f-0ed9-5308-ac72-65b9b3b47ed1"
	strings:
		$s0 = "http://24hack.com/xyadmin.asp" fullword ascii /* PEStudio Blacklist: strings */
		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii /* PEStudio Blacklist: agent */
	condition:
		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
}
YARA Detection Rule: CN_Honker_hxdef100
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file hxdef100.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s6 = "BACKDOORSHELL" fullword ascii /* PEStudio Blacklist: strings */
		$s15 = "%tmpdir%" fullword ascii
		$s16 = "%cmddir%" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and all of them

Full rule:
rule CN_Honker_hxdef100 {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file hxdef100.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "bf30ccc565ac40073b867d4c7f5c33c6bc1920d6"
		id = "3b931752-85ae-52d0-9deb-1a1b03b39e32"
	strings:
		$s6 = "BACKDOORSHELL" fullword ascii /* PEStudio Blacklist: strings */
		$s15 = "%tmpdir%" fullword ascii
		$s16 = "%cmddir%" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and all of them
}
YARA Detection Rule: CN_Honker_Arp_EMP_v1_0
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file Arp EMP v1.0.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s0 = "Arp EMP v1.0.exe" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 400KB and all of them

Full rule:
rule CN_Honker_Arp_EMP_v1_0 {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Arp EMP v1.0.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "ae4954c142ad1552a2abaef5636c7ef68fdd99ee"
		id = "03782e94-4fac-529f-b235-19cdb124d53b"
	strings:
		$s0 = "Arp EMP v1.0.exe" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 400KB and all of them
}