deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Winnti_malware_FWPK
Repository: Neo23x0/signature-base
Detects: Detects a Winnti malware - FWPKCLNT.SYS
Author: Florian Roth (Nextron Systems)
Reference: VTI research

Pattern signatures:
$s0 = "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\" wide
      $s1 = "%x:%d->%x:%d, Flag %s%s%s%s%s, seq %u, ackseq %u, datalen %u" fullword ascii
      $s2 = "FWPKCLNT.SYS" fullword ascii
      $s3 = "Port Layer" fullword wide
      $s4 = "%x->%x, icmp type %d, code %d" fullword ascii
      $s5 = "\\BaseNamedObjects\\{93144EB0-8E3E-4591-B307-8EEBFE7DB28E}" wide
      $s6 = "\\Ndi\\Interfaces" wide
      $s7 = "\\Device\\{93144EB0-8E3E-4591-B307-8EEBFE7DB28F}" wide
      $s8 = "Bad packet" fullword ascii
      $s9 = "\\BaseNamedObjects\\EKV[PII_REDACTED]" wide
      $s10 = "%x->%x" fullword ascii
      $s11 = "IPInjectPkt" fullword ascii /* Goodware String - occured 6 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 642KB and all of them

Full rule:
rule Winnti_malware_FWPK {
   meta:
      description = "Detects a Winnti malware - FWPKCLNT.SYS"
      author = "Florian Roth (Nextron Systems)"
      reference = "VTI research"
      date = "2015-10-10"
      modified = "2023-01-06"
      score = 75
      hash1 = "[PII_REDACTED]c84b0d31f[PII_REDACTED]82bdcd1666653ebc25d50a142b4f5dabf2c"
      hash2 = "9a684ffad0e1c6a22db1bef2399f839d8eff53d7024fb014b9a5f714d11febd7"
      hash3 = "a[PII_REDACTED]71c35e24e94b2be3c2fa4ffa2eb1675d3db3b4456122ff4a71368"
      id = "591ad72d-b9d4-5cd9-9103-37e001026610"
   strings:
      $s0 = "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\" wide
      $s1 = "%x:%d->%x:%d, Flag %s%s%s%s%s, seq %u, ackseq %u, datalen %u" fullword ascii
      $s2 = "FWPKCLNT.SYS" fullword ascii
      $s3 = "Port Layer" fullword wide
      $s4 = "%x->%x, icmp type %d, code %d" fullword ascii
      $s5 = "\\BaseNamedObjects\\{93144EB0-8E3E-4591-B307-8EEBFE7DB28E}" wide
      $s6 = "\\Ndi\\Interfaces" wide
      $s7 = "\\Device\\{93144EB0-8E3E-4591-B307-8EEBFE7DB28F}" wide
      $s8 = "Bad packet" fullword ascii
      $s9 = "\\BaseNamedObjects\\EKV[PII_REDACTED]" wide
      $s10 = "%x->%x" fullword ascii
      $s11 = "IPInjectPkt" fullword ascii /* Goodware String - occured 6 times */
   condition:
      uint16(0) == 0x5a4d and filesize < 642KB and all of them
}
YARA Detection Rule: Winnti_malware_StreamPortal_Gen
Repository: Neo23x0/signature-base
Detects: Detects a Winnti malware - Streamportal
Author: Florian Roth (Nextron Systems)
Reference: VTI research

Pattern signatures:
$s0 = "Proxies destination address/port for TCP" fullword wide
		$s3 = "\\Device\\StreamPortal" wide
		$s4 = "Transport-Data Proxy Sub-Layer" fullword wide
		$s5 = "Cookie: SN=" fullword ascii
		$s6 = "\\BaseNamedObjects\\_transmition_synchronization_" wide
		$s17 = "NTOSKRNL.EXE" fullword wide /* Goodware String - occured 4 times */
		$s19 = "FwpsReferenceNetBufferList0" fullword ascii /* Goodware String - occured 5 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 275KB and all of them

Full rule:
rule Winnti_malware_StreamPortal_Gen {
	meta:
		description = "Detects a Winnti malware - Streamportal"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "VTI research"
		date = "2015-10-10"
		score = 75
		hash1 = "326e2cabddb641777d489a9e7a39d52c0dc2dcb1fde1762554ea162792056b6e"
		hash2 = "[PII_REDACTED]d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
		hash3 = "aff7c7478fe33c57954b6fec2095efe8f9edf5cdb48a680de9439ba62a77945f"
		id = "f9d31d6b-a6f7-5359-b741-960b678e0b9c"
	strings:
		$s0 = "Proxies destination address/port for TCP" fullword wide
		$s3 = "\\Device\\StreamPortal" wide
		$s4 = "Transport-Data Proxy Sub-Layer" fullword wide
		$s5 = "Cookie: SN=" fullword ascii
		$s6 = "\\BaseNamedObjects\\_transmition_synchronization_" wide
		$s17 = "NTOSKRNL.EXE" fullword wide /* Goodware String - occured 4 times */
		$s19 = "FwpsReferenceNetBufferList0" fullword ascii /* Goodware String - occured 5 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 275KB and all of them
}
YARA Detection Rule: WINNTI_KingSoft_Moz_Confustion
Repository: Neo23x0/signature-base
Detects: Detects Barium sample with Copyright confusion
Author: Markus Neis
Reference: https://www.virustotal.com/en/file/070ee4a40852b26ec0cfd79e32176287a6b9d2b15e377281d8414550a83f6496/analysis/

Detection condition:
uint16(0) == 0x5a4d and filesize < 3000KB and (
         pe.imphash() == "7f01b23ccfd1017249c36bc1618d6892" or
         (
            pe.version_info["LegalCopyright"] contains "Mozilla Corporation"
            and pe.version_info["ProductName"] contains "Kingsoft"
         )
      )

Full rule:
rule WINNTI_KingSoft_Moz_Confustion {
   meta:
      description = "Detects Barium sample with Copyright confusion"
      author = "Markus Neis"
      reference = "https://www.virustotal.com/en/file/070ee4a40852b26ec0cfd79e32176287a6b9d2b15e377281d8414550a83f6496/analysis/"
      date = "2018-04-13"
      hash1 = "070ee4a40852b26ec0cfd79e32176287a6b9d2b15e377281d8414550a83f6496"
      id = "0c45c1ff-6734-504f-91d1-cf5d6744252f"
   condition:
      uint16(0) == 0x5a4d and filesize < 3000KB and (
         pe.imphash() == "7f01b23ccfd1017249c36bc1618d6892" or
         (
            pe.version_info["LegalCopyright"] contains "Mozilla Corporation"
            and pe.version_info["ProductName"] contains "Kingsoft"
         )
      )
}
YARA Detection Rule: APT_Winnti_MAL_Dec19_1
Repository: Neo23x0/signature-base
Detects: Detects Winnti malware
Author: Unknown
Reference: https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf

Pattern signatures:
$e1 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411015}" ascii nocase
      $e2 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411014}" ascii nocase
      $e3 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411016}" ascii nocase
      $e4 = "\\BaseNamedObjects\\{B2B87CCA-66BC-4C24-89B2-C23C9EAC2A66}" wide
      $e5 = "BFE_Notify_Event_{7D00FA3C-FBDC-4A8D-AEEB-3F55A4890D2A}" nocase

      $fp1 = "also increase possible memory usage of THOR."

Detection condition:
uint16(0) == 0x5a4d and filesize < 3000KB and
      1 of ($e*) and not 1 of ($fp*)

Full rule:
rule APT_Winnti_MAL_Dec19_1 {
   meta:
      description = "Detects Winnti malware"
      author = "Unknown"
      reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
      date = "2019-12-06"
      modified = "2025-06-03"
      score = 75
      id = "322e9362-bfb6-55e3-9a93-d54246311d11"
   strings:
      $e1 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411015}" ascii nocase
      $e2 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411014}" ascii nocase
      $e3 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411016}" ascii nocase
      $e4 = "\\BaseNamedObjects\\{B2B87CCA-66BC-4C24-89B2-C23C9EAC2A66}" wide
      $e5 = "BFE_Notify_Event_{7D00FA3C-FBDC-4A8D-AEEB-3F55A4890D2A}" nocase

      $fp1 = "also increase possible memory usage of THOR."
   condition:
      uint16(0) == 0x5a4d and filesize < 3000KB and
      1 of ($e*) and not 1 of ($fp*)

}
YARA Detection Rule: APT_Winnti_MAL_Dec19_2
Repository: Neo23x0/signature-base
Detects: Detects Winnti malware
Author: Unknown
Reference: https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf

Pattern signatures:
$a1 = "IPSecMiniPort" wide fullword
      $a2 = "ndis6fw" wide fullword
      $a3 = "TCPIP" wide fullword
      $a4 = "NDIS.SYS" ascii fullword
      $a5 = "ntoskrnl.exe" ascii fullword
      $a6 = "\\BaseNamedObjects\\{B2B87CCA-66BC-4C24-89B2-C23C9EAC2A66}" wide
      $a7 = "\\Device\\Null" wide
      $a8 = "\\Device" wide
      $a9 = "\\Driver" wide
      $b1 = { 66 81 7? ?? 70 17 }
      $b2 = { 81 7? ?? 07 E0 15 00 }
      $b3 = { 8B 46 18 3D 03 60 15 00 }

Detection condition:
(6 of ($a*)) and (2 of ($b*))

Full rule:
rule APT_Winnti_MAL_Dec19_2 {
   meta:
      description = "Detects Winnti malware"
      author = "Unknown"
      reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
      date = "2019-12-06"
      score = 75
      id = "77f2cb7d-90a6-5654-9d2e-6b525cd910a2"
   strings:
      $a1 = "IPSecMiniPort" wide fullword
      $a2 = "ndis6fw" wide fullword
      $a3 = "TCPIP" wide fullword
      $a4 = "NDIS.SYS" ascii fullword
      $a5 = "ntoskrnl.exe" ascii fullword
      $a6 = "\\BaseNamedObjects\\{B2B87CCA-66BC-4C24-89B2-C23C9EAC2A66}" wide
      $a7 = "\\Device\\Null" wide
      $a8 = "\\Device" wide
      $a9 = "\\Driver" wide
      $b1 = { 66 81 7? ?? 70 17 }
      $b2 = { 81 7? ?? 07 E0 15 00 }
      $b3 = { 8B 46 18 3D 03 60 15 00 }
   condition:
      (6 of ($a*)) and (2 of ($b*))
}
YARA Detection Rule: APT_Winnti_MAL_Dec19_3
Repository: Neo23x0/signature-base
Detects: Detects Winnti malware
Author: Unknown
Reference: https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf

Pattern signatures:
$b1 = { 0F B7 ?? 16 [0-1] (81 E? | 25) 00 20 [8-10] 8B ?? 50 41 B9 40 00 00 00 41 B8 00 10 00 00 }
      $b2 = { 8B 40 28 [5-8] 48 03 C8 48 8B C1 [5-8] 48 89 41 28 }
      $b3 = { 48 6B ?? 28 [5-8] 8B ?? ?? 10 [5-8] 48 6B ?? 28 [5-8] 8B ?? ?? 14 }
      $b4 = { 83 B? 90 00 00 00 00 0F 84 [9-12] 83 B? 94 00 00 00 00 0F 84 }
      $b5 = { (45 | 4D) (31 | 33) C0 BA 01 00 00 00 [10-16] FF 5? 28 [0-1] (84 | 85) C0 }

Detection condition:
(4 of ($b*))

Full rule:
rule APT_Winnti_MAL_Dec19_3 {
   meta:
      description = "Detects Winnti malware"
      author = "Unknown"
      reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
      date = "2019-12-06"
      score = 75
      id = "2e001c91-0794-5940-ad8c-8e58a01e100c"
   strings:
      $b1 = { 0F B7 ?? 16 [0-1] (81 E? | 25) 00 20 [8-10] 8B ?? 50 41 B9 40 00 00 00 41 B8 00 10 00 00 }
      $b2 = { 8B 40 28 [5-8] 48 03 C8 48 8B C1 [5-8] 48 89 41 28 }
      $b3 = { 48 6B ?? 28 [5-8] 8B ?? ?? 10 [5-8] 48 6B ?? 28 [5-8] 8B ?? ?? 14 }
      $b4 = { 83 B? 90 00 00 00 00 0F 84 [9-12] 83 B? 94 00 00 00 00 0F 84 }
      $b5 = { (45 | 4D) (31 | 33) C0 BA 01 00 00 00 [10-16] FF 5? 28 [0-1] (84 | 85) C0 }
   condition:
      (4 of ($b*))
}
YARA Detection Rule: APT_Winnti_MAL_Dec19_4
Repository: Neo23x0/signature-base
Detects: Detects Winnti malware
Author: Unknown
Reference: https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf

Pattern signatures:
$b1 = { 4C 8D 41 24 33 D2 B9 03 00 1F 00 FF 9? F8 00 00 00 48 85 C0 74 }
      $b2 = { 4C 8B 4? 08 BA 01 00 00 00 49 8B C? FF D0 85 C0 [2-6] C7 4? 1C 01 00 00 00 B8 01 00 00 00 }
      $b3 = { 8B 4B E4 8B 53 EC 41 B8 00 40 00 00 4? 0B C? FF 9? B8 00 00 00 EB }

Detection condition:
(2 of ($b*))

Full rule:
rule APT_Winnti_MAL_Dec19_4 {
   meta:
      description = "Detects Winnti malware"
      author = "Unknown"
      reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
      date = "2019-12-06"
      score = 75
      id = "1f7ac215-d049-5b97-9797-9589a70cbf2b"
   strings:
      $b1 = { 4C 8D 41 24 33 D2 B9 03 00 1F 00 FF 9? F8 00 00 00 48 85 C0 74 }
      $b2 = { 4C 8B 4? 08 BA 01 00 00 00 49 8B C? FF D0 85 C0 [2-6] C7 4? 1C 01 00 00 00 B8 01 00 00 00 }
      $b3 = { 8B 4B E4 8B 53 EC 41 B8 00 40 00 00 4? 0B C? FF 9? B8 00 00 00 EB }
   condition:
      (2 of ($b*))
}
YARA Detection Rule: APT_Winnti_MAL_Dec19_5
Repository: Neo23x0/signature-base
Detects: Detects Winnti malware
Author: Unknown
Reference: https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf

Pattern signatures:
$a1 = "-k netsvcs" ascii
      $a2 = "svchost.exe" ascii fullword
      $a3 = "%SystemRoot%\\System32\\ntoskrnl.exe" ascii
      $a4 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411015}" ascii
      $a5 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411014}" ascii
      $a6 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411016}" ascii
      $a7 = "cmd.exe" wide
      $a8 = ",XML" wide
      $a9 = "\\rundll32.exe" wide
      $a10 = "\\conhost.exe" wide
      $a11 = "\\cmd.exe" wide
      $a12 = "NtQueryInformationProcess" ascii
      $a13 = "Detours!" ascii fullword
      $a14 = "Loading modified build of detours library designed for MPC-HC player (http://sourceforge.net/projects/mpc-hc/)" ascii
      $a15 = "CONOUT$" wide fullword
      $a16 = { C6 0? E9 4? 8? 4? 05 [2] 89 4? 01 }

Detection condition:
(12 of ($a*))

Full rule:
rule APT_Winnti_MAL_Dec19_5 {
   meta:
      description = "Detects Winnti malware"
      author = "Unknown"
      reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
      date = "2019-12-06"
      score = 75
      id = "2a8f28e6-5a01-5a2f-b89b-9c34163afcda"
   strings:
      $a1 = "-k netsvcs" ascii
      $a2 = "svchost.exe" ascii fullword
      $a3 = "%SystemRoot%\\System32\\ntoskrnl.exe" ascii
      $a4 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411015}" ascii
      $a5 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411014}" ascii
      $a6 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411016}" ascii
      $a7 = "cmd.exe" wide
      $a8 = ",XML" wide
      $a9 = "\\rundll32.exe" wide
      $a10 = "\\conhost.exe" wide
      $a11 = "\\cmd.exe" wide
      $a12 = "NtQueryInformationProcess" ascii
      $a13 = "Detours!" ascii fullword
      $a14 = "Loading modified build of detours library designed for MPC-HC player (http://sourceforge.net/projects/mpc-hc/)" ascii
      $a15 = "CONOUT$" wide fullword
      $a16 = { C6 0? E9 4? 8? 4? 05 [2] 89 4? 01 }
   condition:
      (12 of ($a*))
}
YARA Detection Rule: APT_CN_Group_Loader_Jan20_1
Repository: Neo23x0/signature-base
Detects: Detects loaders used by Chinese groups
Author: Vitali Kremez
Reference: https://twitter.com/VK_Intel/status/[PII_REDACTED]67785472?s=20

Pattern signatures:
$xc1 = { 8B C3 C1 E3 10 C1 E8 10 03 D8 6B DB 77 83 C3 13 }

Detection condition:
1 of them

Full rule:
rule APT_CN_Group_Loader_Jan20_1 {
   meta:
      description = "Detects loaders used by Chinese groups"
      author = "Vitali Kremez"
      reference = "https://twitter.com/VK_Intel/status/[PII_REDACTED]67785472?s=20"
      date = "2020-02-01"
      score = 80
      id = "c85ae499-4f76-56ff-877d-887e1a7fc077"
   strings:
      $xc1 = { 8B C3 C1 E3 10 C1 E8 10 03 D8 6B DB 77 83 C3 13 }
   condition:
      1 of them
}
YARA Detection Rule: MAL_Xbash_PY_Sep18
Repository: Neo23x0/signature-base
Detects: Detects Xbash malware
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/

Pattern signatures:
$s1 = { 73 58 62 61 73 68 00 00 00 00 00 00 00 00 } /* sXbash\x00\x00\x00\x00\x00\x00 */

Detection condition:
uint16(0) == 0x457f and filesize < 10000KB and 1 of them

Full rule:
rule MAL_Xbash_PY_Sep18 {
   meta:
      description = "Detects Xbash malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
      date = "2018-09-18"
      hash1 = "7a18c7bdf0c504832c8552766dcfe0ba33dd5493daa3d9dbe9c985c1ce36e5aa"
      id = "97512fe8-002f-5cbc-a915-d55c087fbef7"
   strings:
      $s1 = { 73 58 62 61 73 68 00 00 00 00 00 00 00 00 } /* sXbash\x00\x00\x00\x00\x00\x00 */
   condition:
      uint16(0) == 0x457f and filesize < 10000KB and 1 of them
}
YARA Detection Rule: MAL_Xbash_SH_Sep18
Repository: Neo23x0/signature-base
Detects: Detects Xbash malware
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/

Pattern signatures:
$s1 = "echo \"*/5 * * * * curl -fsSL" fullword ascii
      $s2 = ".sh|sh\" > /var/spool/cron/root" ascii
      $s3 = "#chmod +x /tmp/hawk" fullword ascii
      $s4 = "if [ ! -f \"/tmp/root.sh\" ]" fullword ascii
      $s5 = ".sh > /tmp/lower.sh" ascii
      $s6 = "chmod 777 /tmp/root.sh" fullword ascii
      $s7 = "-P /tmp && chmod +x /tmp/pools.txt" fullword ascii
      $s8 = "-C /tmp/pools.txt>/dev/null 2>&1" ascii

Detection condition:
uint16(0) == 0x2123 and filesize < 3KB and 1 of them

Full rule:
rule MAL_Xbash_SH_Sep18 {
   meta:
      description = "Detects Xbash malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
      date = "2018-09-18"
      modified = "2023-01-06"
      hash1 = "a27acc07844bb751ac33f5df569fd949d8b61dba26eb5447482d90243fc739af"
      hash2 = "de63ce4a42f06a5903b9daa62b67fcfbdeca05beb574f966370a6ae7fd21190d"
      id = "450ef15f-fe9c-5809-9077-457a43326bfe"
   strings:
      $s1 = "echo \"*/5 * * * * curl -fsSL" fullword ascii
      $s2 = ".sh|sh\" > /var/spool/cron/root" ascii
      $s3 = "#chmod +x /tmp/hawk" fullword ascii
      $s4 = "if [ ! -f \"/tmp/root.sh\" ]" fullword ascii
      $s5 = ".sh > /tmp/lower.sh" ascii
      $s6 = "chmod 777 /tmp/root.sh" fullword ascii
      $s7 = "-P /tmp && chmod +x /tmp/pools.txt" fullword ascii
      $s8 = "-C /tmp/pools.txt>/dev/null 2>&1" ascii
   condition:
      uint16(0) == 0x2123 and filesize < 3KB and 1 of them
}
YARA Detection Rule: MAL_Xbash_JS_Sep18
Repository: Neo23x0/signature-base
Detects: Detects XBash malware
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/

Pattern signatures:
$s1 = "var path=WSHShell" fullword ascii
      $s2 = "var myObject= new ActiveXObject(" ascii
      $s3 = "window.resizeTo(0,0)" fullword ascii
      $s4 = "<script language=\"JScript\">" fullword ascii /* Goodware String - occured 4 times */

Detection condition:
filesize < 5KB and 3 of them

Full rule:
rule MAL_Xbash_JS_Sep18 {
   meta:
      description = "Detects XBash malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
      date = "2018-09-18"
      modified = "2023-01-06"
      hash1 = "f888dda9ca1876eba12ffb55a7a993bd1f5a622a30045a675da4955ede3e4cb8"
      id = "e891d146-f92d-5144-a1f2-ad308e309870"
   strings:
      $s1 = "var path=WSHShell" fullword ascii
      $s2 = "var myObject= new ActiveXObject(" ascii
      $s3 = "window.resizeTo(0,0)" fullword ascii
      $s4 = "<script language=\"JScript\">" fullword ascii /* Goodware String - occured 4 times */
   condition:
      filesize < 5KB and 3 of them
}
YARA Detection Rule: HKTL_FRP_Apr20_1
Repository: Neo23x0/signature-base
Detects: Detects FRP fast reverse proxy tool often used by threat groups
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/fatedier/frp

Pattern signatures:
$x1 = "frp/vendor/github.com/spf13/" ascii
      $x2 = "github.com/fatedier/frp/vendor/" ascii

      $fpg2 = "<html"
      $fpg3 = "<HTML"
      $fpg6 = "<?xml"

Detection condition:
1 of ($x*) and not 1 of ($fp*)

Full rule:
rule HKTL_FRP_Apr20_1 {
   meta:
      description = "Detects FRP fast reverse proxy tool often used by threat groups"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/fatedier/frp"
      date = "2020-04-07"
      modified = "2022-11-03"
      score = 70
      hash1 = "05537c1c4e29db76a24320fb7cb80b189860389cdb16a9dbeb0c8d30d9b37006"
      hash2 = "08c685c8febb5385f7548c2a64a27bae7123a937c5af958ebc08a3accb29978d"
      id = "55483832-0e0b-5c28-8be5-dbd14ddb50e3"
   strings:
      $x1 = "frp/vendor/github.com/spf13/" ascii
      $x2 = "github.com/fatedier/frp/vendor/" ascii

      $fpg2 = "<html"
      $fpg3 = "<HTML"
      $fpg6 = "<?xml"
   condition:
      1 of ($x*) and not 1 of ($fp*)
}
YARA Detection Rule: HKTL_FRP_INI_Apr20_1
Repository: Neo23x0/signature-base
Detects: Detects FRP fast reverse proxy tool INI file often used by threat groups
Author: Florian Roth (Nextron Systems)
Reference: Chinese Hacktools OpenDir

Pattern signatures:
$h1 = "[common]" ascii
      $s1 = "server_addr =" ascii fullword
      $s2 = "remote_port =" ascii fullword
      $s3 = "[RemoteDesktop]" ascii fullword
      $s4 = "local_ip = " ascii
      $s5 = "type = tcp" ascii fullword

Detection condition:
uint16(0) == 0x635b and
      filesize < 1KB and
      $h1 at 0 and all of them

Full rule:
rule HKTL_FRP_INI_Apr20_1 {
   meta:
      description = "Detects FRP fast reverse proxy tool INI file often used by threat groups"
      author = "Florian Roth (Nextron Systems)"
      reference = "Chinese Hacktools OpenDir"
      date = "2020-04-07"
      score = 60
      hash1 = "1dabef3c170e4e559c50d603d47fb7f66f6e3da75a65c3435b18175d6e9785bb"
      id = "5c652c9c-715d-5ba5-821a-3e533b1e78c6"
   strings:
      $h1 = "[common]" ascii
      $s1 = "server_addr =" ascii fullword
      $s2 = "remote_port =" ascii fullword
      $s3 = "[RemoteDesktop]" ascii fullword
      $s4 = "local_ip = " ascii
      $s5 = "type = tcp" ascii fullword
   condition:
      uint16(0) == 0x635b and
      filesize < 1KB and
      $h1 at 0 and all of them
}