deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EquationGroup_sshobo
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file sshobo
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$x1 = "Requested forwarding of port %d but user is not root." fullword ascii
      $x2 = "internal error: we do not read, but chan_read_failed for istate" fullword ascii
      $x3 = "~#  - list forwarded connections" fullword ascii
      $x4 = "packet_inject_ignore: block" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 600KB and all of them )

Full rule:
rule EquationGroup_sshobo {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file sshobo"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "c7491898a0a77981c44847eb00fb0b186aa79a219a35ebbca944d627eefa7d45"
      id = "b9392aec-34a8-5ad2-b3fd-eea907d19701"
   strings:
      $x1 = "Requested forwarding of port %d but user is not root." fullword ascii
      $x2 = "internal error: we do not read, but chan_read_failed for istate" fullword ascii
      $x3 = "~#  - list forwarded connections" fullword ascii
      $x4 = "packet_inject_ignore: block" fullword ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 600KB and all of them )
}
YARA Detection Rule: EquationGroup_magicjack_v1_1_0_0_client_1_1_0_0
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file magicjack_v1.1.0.0_client-1.1.0.0.py
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$x1 = "result = self.send_command(\"ls -al %s\" % self.options.DIR)" fullword ascii
      $x2 = "cmd += \"D=-l%s \" % self.options.LISTEN_PORT" fullword ascii

Detection condition:
( uint16(0) == 0x2123 and filesize < 80KB and 1 of them )

Full rule:
rule EquationGroup_magicjack_v1_1_0_0_client_1_1_0_0 {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file magicjack_v1.1.0.0_client-1.1.0.0.py"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "63292a2353275a3bae012717bb500d5169cd024064a1ce8355ecb4e9bfcdfdd1"
      id = "008cb5cf-1d2d-5312-9474-2f93db190974"
   strings:
      $x1 = "result = self.send_command(\"ls -al %s\" % self.options.DIR)" fullword ascii
      $x2 = "cmd += \"D=-l%s \" % self.options.LISTEN_PORT" fullword ascii
   condition:
      ( uint16(0) == 0x2123 and filesize < 80KB and 1 of them )
}
YARA Detection Rule: EquationGroup_packrat
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file packrat
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$x2 = "Use this on target to get your RAT:" fullword ascii
      $x3 = "$ratremotename && " fullword ascii
      $x5 = "$command = \"$nc$bindto -vv -l -p $port < ${ratremotename}\" ;" fullword ascii

Detection condition:
( filesize < 70KB and 1 of them )

Full rule:
rule EquationGroup_packrat {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file packrat"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "d3e067879c51947d715fc2cf0d8d91c897fe9f50cae6784739b5c17e8a8559cf"
      id = "4c0619c4-728f-591f-aa02-7c28f1f42fd1"
   strings:
      $x2 = "Use this on target to get your RAT:" fullword ascii
      $x3 = "$ratremotename && " fullword ascii
      $x5 = "$command = \"$nc$bindto -vv -l -p $port < ${ratremotename}\" ;" fullword ascii
   condition:
      ( filesize < 70KB and 1 of them )
}
YARA Detection Rule: EquationGroup_telex
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file telex
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$x1 = "usage: %s -l [ netcat listener ] [ -p optional target port instead of 23 ] <ip>" fullword ascii
      $x2 = "target is not vulnerable. exiting" fullword ascii
      $s3 = "Sending final buffer: evil_blocks and shellcode..." fullword ascii
      $s4 = "Timeout waiting for daemon to die.  Exploit probably failed." fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 50KB and 1 of them )

Full rule:
rule EquationGroup_telex {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file telex"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "e9713b15fc164e0f64783e7a2eac189a40e0a60e2268bd7132cfdc624dfe54ef"
      id = "23571734-869d-5d68-9339-d82f168c2e47"
   strings:
      $x1 = "usage: %s -l [ netcat listener ] [ -p optional target port instead of 23 ] <ip>" fullword ascii
      $x2 = "target is not vulnerable. exiting" fullword ascii
      $s3 = "Sending final buffer: evil_blocks and shellcode..." fullword ascii
      $s4 = "Timeout waiting for daemon to die.  Exploit probably failed." fullword ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 50KB and 1 of them )
}
YARA Detection Rule: EquationGroup_calserver
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file calserver
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$x1 = "usage: %s <host> <port> e <contents of a local file to be executed on target>" fullword ascii
      $x2 = "Writing your %s to target." fullword ascii
      $x3 = "(e)xploit, (r)ead, (m)ove and then write, (w)rite" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 30KB and 1 of them )

Full rule:
rule EquationGroup_calserver {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file calserver"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "048625e9a0ca46d7fe221e262c8dd05e7a5339990ffae2fb65a9b0d705ad6099"
      id = "abe935ee-8579-54f0-b6d3-172d6e2c0482"
   strings:
      $x1 = "usage: %s <host> <port> e <contents of a local file to be executed on target>" fullword ascii
      $x2 = "Writing your %s to target." fullword ascii
      $x3 = "(e)xploit, (r)ead, (m)ove and then write, (w)rite" fullword ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 30KB and 1 of them )
}
YARA Detection Rule: EquationGroup_porkclient
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file porkclient
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$s1 = "-c COMMAND: shell command string" fullword ascii
      $s2 = "Cannot combine shell command mode with args to do socket reuse" fullword ascii
      $s3 = "-r: Reuse socket for Nopen connection (requires -t, -d, -f, -n, NO -c)" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 30KB and 1 of them )

Full rule:
rule EquationGroup_porkclient {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file porkclient"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "5c14e3bcbf230a1d7e2909876b045e34b1486c8df3c85fb582d9c93ad7c57748"
      id = "5b34d5f9-bc76-5cc7-92f7-32c2b7ef7bcf"
   strings:
      $s1 = "-c COMMAND: shell command string" fullword ascii
      $s2 = "Cannot combine shell command mode with args to do socket reuse" fullword ascii
      $s3 = "-r: Reuse socket for Nopen connection (requires -t, -d, -f, -n, NO -c)" fullword ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 30KB and 1 of them )
}
YARA Detection Rule: EquationGroup_electricslide
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file electricslide
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$x1 = "Firing with the same hosts, on altername ports (target is on 8080, listener on 443)" fullword ascii
      $x2 = "Recieved Unknown Command Payload: 0x%x" fullword ascii
      $x3 = "Usage: eslide   [options] <-t profile> <-l listenerip> <targetip>" fullword ascii
      $x4 = "-------- Delete Key - Remove a *closed* tab" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 2000KB and 1 of them )

Full rule:
rule EquationGroup_electricslide {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file electricslide"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "d27814b725568fa73641e86fa51850a17e54905c045b8b31a9a5b6d2bdc6f014"
      id = "5b1e5293-806a-58e6-b865-66025c8d8c32"
   strings:
      $x1 = "Firing with the same hosts, on altername ports (target is on 8080, listener on 443)" fullword ascii
      $x2 = "Recieved Unknown Command Payload: 0x%x" fullword ascii
      $x3 = "Usage: eslide   [options] <-t profile> <-l listenerip> <targetip>" fullword ascii
      $x4 = "-------- Delete Key - Remove a *closed* tab" fullword ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 2000KB and 1 of them )
}
YARA Detection Rule: EquationGroup_libXmexploit2
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file libXmexploit2.8
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$s1 = "Usage: ./exp command display_to_return_to" fullword ascii
      $s2 = "sizeof shellcode = %d" fullword ascii
      $s3 = "Execve failed!" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 40KB and 1 of them )

Full rule:
rule EquationGroup_libXmexploit2 {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file libXmexploit2.8"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "d7ed0234d074266cb37dd6a6a60119adb7d75cc6cc3b38654c8951b643944796"
      id = "30e94123-acc9-5185-9f5b-1f956c4cf3d1"
   strings:
      $s1 = "Usage: ./exp command display_to_return_to" fullword ascii
      $s2 = "sizeof shellcode = %d" fullword ascii
      $s3 = "Execve failed!" fullword ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 40KB and 1 of them )
}
YARA Detection Rule: EquationGroup_wrap_telnet
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file wrap-telnet.sh
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$s1 = "echo \"example: ${0} -l 192.168.1.1 -p 22222 -s 22223 -x 9999\"" fullword ascii
      $s2 = "-x [ port to start mini X server on DEFAULT = 12121 ]\"" fullword ascii
      $s3 = "echo \"Call back port2 = ${SPORT}\"" fullword ascii

Detection condition:
( uint16(0) == 0x2123 and filesize < 4KB and 1 of them )

Full rule:
rule EquationGroup_wrap_telnet {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file wrap-telnet.sh"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "4962b307a42ba18e987d82aa61eba[PII_REDACTED]d0e2f0e4beb02371bf0fd5b4"
      id = "158e6ebc-6b43-5e94-9052-31408d848875"
   strings:
      $s1 = "echo \"example: ${0} -l 192.168.1.1 -p 22222 -s 22223 -x 9999\"" fullword ascii
      $s2 = "-x [ port to start mini X server on DEFAULT = 12121 ]\"" fullword ascii
      $s3 = "echo \"Call back port2 = ${SPORT}\"" fullword ascii
   condition:
      ( uint16(0) == 0x2123 and filesize < 4KB and 1 of them )
}
YARA Detection Rule: EquationGroup_elgingamble
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file elgingamble
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$x1 = "* * * * * root chown root %s; chmod 4755 %s; %s" fullword ascii
      $x2 = "[-] kernel not vulnerable" fullword ascii
      $x3 = "[-] failed to spawn shell: %s" fullword ascii
      $x4 = "-s shell           Use shell instead of %s" fullword ascii

Detection condition:
1 of them

Full rule:
rule EquationGroup_elgingamble {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file elgingamble"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "0573e12632e6c1925358f4bfecf8c263dd13edf52c633c9109fe3aae059b49dd"
      id = "fc8a63a1-9deb-5051-a02d-ed26fd1cae95"
   strings:
      $x1 = "* * * * * root chown root %s; chmod 4755 %s; %s" fullword ascii
      $x2 = "[-] kernel not vulnerable" fullword ascii
      $x3 = "[-] failed to spawn shell: %s" fullword ascii
      $x4 = "-s shell           Use shell instead of %s" fullword ascii
   condition:
      1 of them
}
YARA Detection Rule: EquationGroup_cmsd
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file cmsd
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$x1 = "usage: %s address [-t][-s|-c command] [-p port] [-v 5|6|7]" fullword ascii
      $x2 = "error: not vulnerable" fullword ascii

      $s1 = "port=%d connected! " fullword ascii
      $s2 = "xxx.XXXXXX" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 30KB and 1 of ($x*) ) or ( 2 of them )

Full rule:
rule EquationGroup_cmsd {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file cmsd"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "634c50614e1f5f132f49ae204c4a28f62a32a39a3446084db5b0b49b564034b8"
      id = "9cdd3562-fed4-5b79-b[PII_REDACTED]04eeb"
   strings:
      $x1 = "usage: %s address [-t][-s|-c command] [-p port] [-v 5|6|7]" fullword ascii
      $x2 = "error: not vulnerable" fullword ascii

      $s1 = "port=%d connected! " fullword ascii
      $s2 = "xxx.XXXXXX" fullword ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 30KB and 1 of ($x*) ) or ( 2 of them )
}
YARA Detection Rule: EquationGroup_ebbshave
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file ebbshave.v5
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$s1 = "executing ./ebbnew_linux -r %s -v %s -A %s %s -t %s -p %s" fullword ascii
      $s2 = "./ebbnew_linux.wrapper -o 2 -v 2 -t 192.168.10.4 -p 32772" fullword ascii
      $s3 = "version 1 - Start with option #18 first, if it fails then try this option" fullword ascii
      $s4 = "%s is a wrapper program for ebbnew_linux exploit for Sparc Solaris RPC services" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 20KB and 1 of them ) or ( 2 of them )

Full rule:
rule EquationGroup_ebbshave {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file ebbshave.v5"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "eb5e0053299e087c87c2d5c6f90531cc1946019c85a43a2998c7b66a6f19ca4b"
      id = "6d4c14e2-afb1-57ce-91df-cb024258250e"
   strings:
      $s1 = "executing ./ebbnew_linux -r %s -v %s -A %s %s -t %s -p %s" fullword ascii
      $s2 = "./ebbnew_linux.wrapper -o 2 -v 2 -t 192.168.10.4 -p 32772" fullword ascii
      $s3 = "version 1 - Start with option #18 first, if it fails then try this option" fullword ascii
      $s4 = "%s is a wrapper program for ebbnew_linux exploit for Sparc Solaris RPC services" fullword ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 20KB and 1 of them ) or ( 2 of them )
}
YARA Detection Rule: EquationGroup_eggbasket
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file eggbasket
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$x1 = "# Building Shellcode into exploit." fullword ascii
      $x2 = "%s -w /index.html -v 3.5 -t 10 -c \"/usr/openwin/bin/xterm -d 555.1.2.2:0&\"  -d 10.0.0.1 -p 80" fullword ascii
      $x3 = "# STARTING EXHAUSTIVE ATTACK AGAINST " fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 90KB and 1 of them ) or ( 2 of them )

Full rule:
rule EquationGroup_eggbasket {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file eggbasket"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "b078a[PII_REDACTED]5217682e6e1d6ae0b30935273ed98743e47cc2553fbfd068f"
      id = "3fb1388a-e6b8-5c7a-ad23-ddbfc9d33d56"
   strings:
      $x1 = "# Building Shellcode into exploit." fullword ascii
      $x2 = "%s -w /index.html -v 3.5 -t 10 -c \"/usr/openwin/bin/xterm -d 555.1.2.2:0&\"  -d 10.0.0.1 -p 80" fullword ascii
      $x3 = "# STARTING EXHAUSTIVE ATTACK AGAINST " fullword ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 90KB and 1 of them ) or ( 2 of them )
}
YARA Detection Rule: EquationGroup_jparsescan
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file jparsescan
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$s1 = "Usage:  $prog [-f directory] -p prognum [-V ver] [-t proto] -i IPadr" fullword ascii
      $s2 = "$gotsunos = ($line =~ /program version netid     address             service         owner/ );" fullword ascii

Detection condition:
( filesize < 40KB and 1 of them )

Full rule:
rule EquationGroup_jparsescan {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file jparsescan"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "8c248eec0af04300f3ba0188fe757850d283de84cf42109638c1c1280c822984"
      id = "6b6a884e-0bbc-54f5-bb6c-00e15ca95250"
   strings:
      $s1 = "Usage:  $prog [-f directory] -p prognum [-V ver] [-t proto] -i IPadr" fullword ascii
      $s2 = "$gotsunos = ($line =~ /program version netid     address             service         owner/ );" fullword ascii
   condition:
      ( filesize < 40KB and 1 of them )
}
YARA Detection Rule: EquationGroup_sambal
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file sambal
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$s1 = "+ Bruteforce mode." fullword ascii
      $s3 = "+ Host is not running samba!" fullword ascii
      $s4 = "+ connecting back to: [%d.%d.%d.%d:45295]" fullword ascii
      $s5 = "+ Exploit failed, try -b to bruteforce." fullword ascii
      $s7 = "Usage: %s [-bBcCdfprsStv] [host]" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 90KB and 1 of them ) or ( 2 of them )

Full rule:
rule EquationGroup_sambal {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file sambal"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "2abf4bbe4debd619b99cb944298f43312db[PII_REDACTED]e6b71b9ea6e9a1a4fec"
      id = "b02b442c-3e24-55f8-aa5c-926c3a3a75b4"
   strings:
      $s1 = "+ Bruteforce mode." fullword ascii
      $s3 = "+ Host is not running samba!" fullword ascii
      $s4 = "+ connecting back to: [%d.%d.%d.%d:45295]" fullword ascii
      $s5 = "+ Exploit failed, try -b to bruteforce." fullword ascii
      $s7 = "Usage: %s [-bBcCdfprsStv] [host]" fullword ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 90KB and 1 of them ) or ( 2 of them )
}
YARA Detection Rule: EquationGroup_pclean_v2_1_1_2
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file pclean.v2.1.1.0-linux-i386
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$s3 = "** SIGNIFICANTLY IMPROVE PROCESSING TIME" fullword ascii
      $s6 = "-c cmd_name:     strncmp() search for 1st %d chars of commands that " fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 40KB and all of them )

Full rule:
rule EquationGroup_pclean_v2_1_1_2 {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file pclean.v2.1.1.0-linux-i386"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "cdb5b1173e6eb32b5ea494c38764b9975ddfe83aa09ba0634c4bafa41d844c97"
      id = "1b31af01-8c30-513a-a615-82dcb940e06d"
   strings:
      $s3 = "** SIGNIFICANTLY IMPROVE PROCESSING TIME" fullword ascii
      $s6 = "-c cmd_name:     strncmp() search for 1st %d chars of commands that " fullword ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 40KB and all of them )
}