deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: MAL_RANSOM_SH_ESXi_Attacks_Feb23_1
Repository: Neo23x0/signature-base
Detects: Detects script used in ransomware attacks exploiting and encrypting ESXi servers - file encrypt.sh
Author: Florian Roth
Reference: https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-14

Pattern signatures:
$x1 = "/bin/find / -name *.log -exec /bin/rm -rf {} \\;" ascii fullword
      $x2 = "/bin/touch -r /etc/vmware/rhttpproxy/config.xml /bin/hostd-probe.sh" ascii fullword
      $x3 = "grep encrypt | /bin/grep -v grep | /bin/wc -l)" ascii fullword

      $s1 = "## ENCRYPT" ascii fullword
      $s2 = "/bin/find / -name *.log -exec /bin" ascii fullword

Detection condition:
uint16(0) == 0x2123 and
      filesize < 10KB and (
         1 of ($x*)
         or 2 of them
      ) or 3 of them

Full rule:
rule MAL_RANSOM_SH_ESXi_Attacks_Feb23_1 {
   meta:
      description = "Detects script used in ransomware attacks exploiting and encrypting ESXi servers - file encrypt.sh"
      author = "Florian Roth"
      reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-14"
      date = "2023-02-04"
      score = 85
      hash1 = "10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459"
      id = "7178dbe4-f573-5279-a23e-9bab8ae8b743"
   strings:
      $x1 = "/bin/find / -name *.log -exec /bin/rm -rf {} \\;" ascii fullword
      $x2 = "/bin/touch -r /etc/vmware/rhttpproxy/config.xml /bin/hostd-probe.sh" ascii fullword
      $x3 = "grep encrypt | /bin/grep -v grep | /bin/wc -l)" ascii fullword

      $s1 = "## ENCRYPT" ascii fullword
      $s2 = "/bin/find / -name *.log -exec /bin" ascii fullword
   condition:
      uint16(0) == 0x2123 and
      filesize < 10KB and (
         1 of ($x*)
         or 2 of them
      ) or 3 of them
}
YARA Detection Rule: MAL_RANSOM_ELF_ESXi_Attacks_Feb23_1
Repository: Neo23x0/signature-base
Detects: Detects ransomware exploiting and encrypting ESXi servers
Author: Florian Roth
Reference: https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-14

Pattern signatures:
$x1 = "usage: encrypt <public_key> <file_to_encrypt> [<enc_step>] [<enc_size>] [<file_size>]" ascii fullword
      $x2 = "[ %s ] - FAIL { Errno: %d }" ascii fullword

      $s1 = "lPEM_read_bio_RSAPrivateKey" ascii fullword
      $s2 = "lERR_get_error" ascii fullword
      $s3 = "get_pk_data: key file is empty!" ascii fullword

      $op1 = { 8b 45 a8 03 45 d0 89 45 d4 8b 45 a4 69 c0 07 53 65 54 89 45 a8 8b 45 a8 c1 c8 19 }
      $op2 = { 48 89 95 40 fd ff ff 48 83 bd 40 fd ff ff 00 0f 85 2e 01 00 00 48 8b 9d 50 ff ff ff 48 89 9d 30 fd ff ff 48 83 bd 30 fd ff ff 00 78 13 f2 48 0f 2a 85 30 fd ff ff }
      $op3 = { 31 55 b4 f7 55 b8 8b 4d ac 09 4d b8 8b 45 b8 31 45 bc c1 4d bc 13 c1 4d b4 1d }

Detection condition:
uint16(0) == 0x457f and
      filesize < 200KB and (
         1 of ($x*)
         or 3 of them
      ) or 4 of them

Full rule:
rule MAL_RANSOM_ELF_ESXi_Attacks_Feb23_1 {
   meta:
      description = "Detects ransomware exploiting and encrypting ESXi servers"
      author = "Florian Roth"
      reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-14"
      date = "2023-02-04"
      score = 85
      hash1 = "11b1b2375d9d840912cfd1f0d0d04d93ed0cddb0ae4ddb550a5b62cd044d6b66"
      id = "d0a813aa-41f8-57df-b708-18ccb0d7a3e5"
   strings:
      $x1 = "usage: encrypt <public_key> <file_to_encrypt> [<enc_step>] [<enc_size>] [<file_size>]" ascii fullword
      $x2 = "[ %s ] - FAIL { Errno: %d }" ascii fullword

      $s1 = "lPEM_read_bio_RSAPrivateKey" ascii fullword
      $s2 = "lERR_get_error" ascii fullword
      $s3 = "get_pk_data: key file is empty!" ascii fullword

      $op1 = { 8b 45 a8 03 45 d0 89 45 d4 8b 45 a4 69 c0 07 53 65 54 89 45 a8 8b 45 a8 c1 c8 19 }
      $op2 = { 48 89 95 40 fd ff ff 48 83 bd 40 fd ff ff 00 0f 85 2e 01 00 00 48 8b 9d 50 ff ff ff 48 89 9d 30 fd ff ff 48 83 bd 30 fd ff ff 00 78 13 f2 48 0f 2a 85 30 fd ff ff }
      $op3 = { 31 55 b4 f7 55 b8 8b 4d ac 09 4d b8 8b 45 b8 31 45 bc c1 4d bc 13 c1 4d b4 1d }
   condition:
      uint16(0) == 0x457f and
      filesize < 200KB and (
         1 of ($x*)
         or 3 of them
      ) or 4 of them
}
YARA Detection Rule: APT_PY_ESXi_Backdoor_Dec22
Repository: Neo23x0/signature-base
Detects: Detects Python backdoor found on ESXi servers
Author: Florian Roth
Reference: https://blogs.juniper.net/en-us/threat-research/a-custom-python-backdoor-for-vmware-esxi-servers

Pattern signatures:
$x1 = "cmd = str(base64.b64decode(encoded_cmd), " ascii
      $x2 = "sh -i 2>&1 | nc %s %s > /tmp/" ascii

Detection condition:
filesize < 10KB and 1 of them or all of them

Full rule:
rule APT_PY_ESXi_Backdoor_Dec22 {
   meta:
      description = "Detects Python backdoor found on ESXi servers"
      author = "Florian Roth"
      reference = "https://blogs.juniper.net/en-us/threat-research/a-custom-python-backdoor-for-vmware-esxi-servers"
      date = "2022-12-14"
      score = 85
      id = "f0a3b9b9-0031-5d9f-97f8-70f83863ee63"
    strings:
      $x1 = "cmd = str(base64.b64decode(encoded_cmd), " ascii
      $x2 = "sh -i 2>&1 | nc %s %s > /tmp/" ascii
    condition:
      filesize < 10KB and 1 of them or all of them
}
YARA Detection Rule: APT_SH_ESXi_Backdoor_Dec22
Repository: Neo23x0/signature-base
Detects: Detects malicious script found on ESXi servers
Author: Florian Roth
Reference: https://blogs.juniper.net/en-us/threat-research/a-custom-python-backdoor-for-vmware-esxi-servers

Pattern signatures:
$x1 = "mv /bin/hostd-probe.sh /bin/hostd-probe.sh.1" ascii fullword
      $x2 = "/bin/nohup /bin/python -u /store/packages/vmtools.py" ascii
      $x3 = "/bin/rm /bin/hostd-probe.sh.1"

Detection condition:
filesize < 10KB and 1 of them

Full rule:
rule APT_SH_ESXi_Backdoor_Dec22 {
   meta:
      description = "Detects malicious script found on ESXi servers"
      author = "Florian Roth"
      reference = "https://blogs.juniper.net/en-us/threat-research/a-custom-python-backdoor-for-vmware-esxi-servers"
      date = "2022-12-14"
      score = 75
      id = "983ac20c-2e61-5365-8849-b3aeb999f909"
    strings:
      $x1 = "mv /bin/hostd-probe.sh /bin/hostd-probe.sh.1" ascii fullword
      $x2 = "/bin/nohup /bin/python -u /store/packages/vmtools.py" ascii
      $x3 = "/bin/rm /bin/hostd-probe.sh.1"
    condition:
      filesize < 10KB and 1 of them
}
YARA Detection Rule: MAL_RANSOM_SH_ESXi_Attacks_Feb23_2
Repository: Neo23x0/signature-base
Detects: Detects script used in ransomware attacks exploiting and encrypting ESXi servers
Author: Florian Roth
Reference: https://dev.to/xakrume/esxiargs-encryption-malware-launches-massive-attacks-against-vmware-esxi-servers-pfe

Pattern signatures:
$x1 = "echo \"START ENCRYPT: $file_e SIZE: $size_kb STEP SIZE: " ascii

Detection condition:
filesize < 10KB and 1 of them

Full rule:
rule MAL_RANSOM_SH_ESXi_Attacks_Feb23_2 {
   meta:
      description = "Detects script used in ransomware attacks exploiting and encrypting ESXi servers"
      author = "Florian Roth"
      reference = "https://dev.to/xakrume/esxiargs-encryption-malware-launches-massive-attacks-against-vmware-esxi-servers-pfe"
      date = "2023-02-06"
      score = 85
      id = "d1282dee-0496-52f1-a2b7-27657ab4df8c"
   strings:
      $x1 = "echo \"START ENCRYPT: $file_e SIZE: $size_kb STEP SIZE: " ascii
   condition:
      filesize < 10KB and 1 of them
}
YARA Detection Rule: SUSP_ESXiArgs_Endpoint_Conf_Aug23
Repository: Neo23x0/signature-base
Detects: Detects indicators found in endpoint.conf files as modified by actors in the ESXiArgs campaign
Author: Florian Roth
Reference: https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-47

Pattern signatures:
$a1 = "/client/clients.xml" ascii
      $a2 = "/var/run/vmware/proxy-sdk-tunnel" ascii fullword
      $a3 = "redirect" ascii fullword
      $a4 = "allow" ascii fullword

      $s1 = " local 8008 allow allow"

Detection condition:
filesize < 2KB and all of them

Full rule:
rule SUSP_ESXiArgs_Endpoint_Conf_Aug23 {
   meta:
      description = "Detects indicators found in endpoint.conf files as modified by actors in the ESXiArgs campaign"
      author = "Florian Roth"
      reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-47"
      date = "2023-08-04"
      score = 75
      id = "3e0b5dbf-7c5b-5599-823a-ce35fbdbe64b"
   strings:
      $a1 = "/client/clients.xml" ascii
      $a2 = "/var/run/vmware/proxy-sdk-tunnel" ascii fullword
      $a3 = "redirect" ascii fullword
      $a4 = "allow" ascii fullword

      $s1 = " local 8008 allow allow"
   condition:
      filesize < 2KB and all of them
}
YARA Detection Rule: rtf_CVE_2018_0802
Repository: Neo23x0/signature-base
Detects: Attempts to exploit CVE-2018-0802
Author: Rich Warren
Reference: http://www.freebuf.com/vuls/159789.html

Pattern signatures:
$equation = { 45 71 75 61 74 69 6F 6E 2E 33 }
      $header_and_shellcode = /03010[0,1][0-9a-fA-F]{308,310}2500/ ascii nocase

Detection condition:
uint32be(0) == 0x7B5C7274 // RTF header
      and all of them

Full rule:
rule rtf_CVE_2018_0802 {
   meta:
      author = "Rich Warren"
      description = "Attempts to exploit CVE-2018-0802"
      reference = "http://www.freebuf.com/vuls/159789.html"
      id = "162492a3-d792-5f1c-a143-191c62b54728"
   strings:
      $equation = { 45 71 75 61 74 69 6F 6E 2E 33 }
      $header_and_shellcode = /03010[0,1][0-9a-fA-F]{308,310}2500/ ascii nocase
   condition:
      uint32be(0) == 0x7B5C7274 // RTF header
      and all of them
}
YARA Detection Rule: TA459_Malware_May17_1
Repository: Neo23x0/signature-base
Detects: Detects TA459 related malware
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/RLf9qU

Pattern signatures:
$s3 = "xtsewy" fullword ascii
      $s6 = "CW&mhAklnfVULL" ascii

Detection condition:
( uint16(0) == 0x6152 and filesize < 800KB and all of them )

Full rule:
rule TA459_Malware_May17_1 {
   meta:
      description = "Detects TA459 related malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/RLf9qU"
      date = "2017-05-31"
      hash1 = "5fd61793d498a395861fa263e4438183a3c4e6f1e4f098ac6e97c9d0911327bf"
      id = "eb5d2464-ab95-5f5d-8b20-fa023da53130"
   strings:
      $s3 = "xtsewy" fullword ascii
      $s6 = "CW&mhAklnfVULL" ascii
   condition:
      ( uint16(0) == 0x6152 and filesize < 800KB and all of them )
}
YARA Detection Rule: TA459_Malware_May17_2
Repository: Neo23x0/signature-base
Detects: Detects TA459 related malware
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/RLf9qU

Pattern signatures:
$a1 = "Mcutil.dll" fullword ascii
      $a2 = "mcut.exe" fullword ascii

      $s1 = "Software\\WinRAR SFX" fullword ascii
      $s2 = "AYou may need to run this self-extracting archive as administrator" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 900KB and all of ($a*) and 1 of ($s*) )

Full rule:
rule TA459_Malware_May17_2 {
   meta:
      description = "Detects TA459 related malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/RLf9qU"
      date = "2017-05-31"
      hash1 = "4601133e94c4bc74916a9d96a5bc27cc3125cdc0be7225b2c7d4047f8506b3aa"
      id = "62[PII_REDACTED]-5ded-9883-bb78eac697fb"
   strings:
      $a1 = "Mcutil.dll" fullword ascii
      $a2 = "mcut.exe" fullword ascii

      $s1 = "Software\\WinRAR SFX" fullword ascii
      $s2 = "AYou may need to run this self-extracting archive as administrator" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 900KB and all of ($a*) and 1 of ($s*) )
}
YARA Detection Rule: FakeM_Generic
Repository: Neo23x0/signature-base
Detects: Detects FakeM malware samples
Author: Florian Roth (Nextron Systems)
Reference: http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/

Pattern signatures:
$a1 = "\\system32\\kernel32.dll" ascii
		$a2 = "\\boot.lnk" ascii
		$a3 = "%USERPROFILE%" fullword ascii /* Goodware String - occured 16 times */

		$b1 = "Wizard.EXE" fullword wide
		$b2 = "CommandLineA" fullword ascii

		$c1 = "\\system32\\kernel32.dll" ascii
		$c2 = "\\aapz.tmp" ascii

		$e1 = "C:\\Documents and Settings\\A\\" ascii
		$e2 = "\\svchost.exe" ascii
		$e3 = "\\Perform\\Release\\Perform.pdb" ascii

		$f1 = "Browser.EXE" fullword wide
		$f2 = "\\browser.exe" ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and
		( all of ($a*) or all of ($b*) or all of ($c*) or all of ($e*) or 1 of ($f*) )

Full rule:
rule FakeM_Generic {
	meta:
		description = "Detects FakeM malware samples"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"
		date = "2016-01-25"
		modified = "2023-01-06"
		score = 85
		hash1 = "631fc66e57acd52284aba2608e6f31ba19e2807367e33d8704f572f6af6bd9c3"
		hash2 = "3d9bd26f5bd5401efa17690357f40054a3d7b438ce8c91367dbf469f0d9bd520"
		hash3 = "53af257a42a8f182e97dcbb8d22227c27d654bea756d7f34a80cc7982b70aa60"
		hash4 = "4a4dfffae6fc8be77ac9b2c67da547f0d57ffae59e0687a356f5105fdddc88a3"
		hash5 = "7bfbf49aa71b8235a16792ef721b7e4195df11cb75371f651595b37690d108c8"
		hash6 = "12dedcdda853da[PII_REDACTED]e6b4a5d6a82ba0cf61d7fa4cbe444a010f682b5d"
		hash7 = "9adda3d95535c6cf83a1ba08fe83f718f5c722e06d0caff8eab4a564185971c5"
		hash8 = "3209ab95ca7ee7d8c0140f95bdb61a37d69810a7a23d90d63ecc69cc8c51db90"
		hash9 = "41948c73b776b673f954f497e09cc469d55f27e7b6e19acb41b77f7e64c50a33"
		hash10 = "53cecc0d0f6924eacd23c49d0d95a[PII_REDACTED]fbbe2356778feb8dd396d723e"
		hash11 = "523ad50b498bfb5ab688d9b1958c8058f905b634befc65e96f9f947e40893e5b"
		id = "51a285ce-a4cb-5068-b079-a[PII_REDACTED]f"
	strings:
		$a1 = "\\system32\\kernel32.dll" ascii
		$a2 = "\\boot.lnk" ascii
		$a3 = "%USERPROFILE%" fullword ascii /* Goodware String - occured 16 times */

		$b1 = "Wizard.EXE" fullword wide
		$b2 = "CommandLineA" fullword ascii

		$c1 = "\\system32\\kernel32.dll" ascii
		$c2 = "\\aapz.tmp" ascii

		$e1 = "C:\\Documents and Settings\\A\\" ascii
		$e2 = "\\svchost.exe" ascii
		$e3 = "\\Perform\\Release\\Perform.pdb" ascii

		$f1 = "Browser.EXE" fullword wide
		$f2 = "\\browser.exe" ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and
		( all of ($a*) or all of ($b*) or all of ($c*) or all of ($e*) or 1 of ($f*) )
}
YARA Detection Rule: OilRig_Strings_Oct17
Repository: Neo23x0/signature-base
Detects: Detects strings from OilRig malware and malicious scripts
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2017/10/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/

Pattern signatures:
$x1 = "%localappdata%\\srvHealth.exe" fullword wide ascii
      $x2 = "%localappdata%\\srvBS.txt" fullword wide ascii
      $x3 = "Agent Injector\\PolicyConverter\\Inner\\obj\\Release\\Inner.pdb" ascii
      $x4 = "Agent Injector\\PolicyConverter\\Joiner\\obj\\Release\\Joiner.pdb" ascii
      $s3 = ".LoadDll(\"Run\", arg, \"C:\\\\Windows\\\\" ascii

Detection condition:
filesize < 800KB and 1 of them

Full rule:
rule OilRig_Strings_Oct17 {
   meta:
      description = "Detects strings from OilRig malware and malicious scripts"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/"
      date = "2017-10-18"
      modified = "2022-12-21"
      id = "edf7c7ca-0c58-5507-8d99-83078ff8947a"
   strings:
      $x1 = "%localappdata%\\srvHealth.exe" fullword wide ascii
      $x2 = "%localappdata%\\srvBS.txt" fullword wide ascii
      $x3 = "Agent Injector\\PolicyConverter\\Inner\\obj\\Release\\Inner.pdb" ascii
      $x4 = "Agent Injector\\PolicyConverter\\Joiner\\obj\\Release\\Joiner.pdb" ascii
      $s3 = ".LoadDll(\"Run\", arg, \"C:\\\\Windows\\\\" ascii
   condition:
      filesize < 800KB and 1 of them
}
YARA Detection Rule: OilRig_ISMAgent_Campaign_Samples1
Repository: Neo23x0/signature-base
Detects: Detects OilRig malware from Unit 42 report in October 2017
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/JQVfFP

Pattern signatures:
$s1 = "###$$$TVqQAAMAAAAEAAAA" ascii
      $s2 = "C:\\Users\\J-Win-7-32-Vm\\Desktop\\error.jpg" fullword wide
      $s3 = "$DATA = [System.Convert]::FromBase64String([IO.File]::ReadAllText('%Base%'));[io.file]::WriteAllBytes(" ascii
      $s4 = " /c echo powershell > " fullword wide ascii
      $s5 = "\\Libraries\\servicereset.exe" wide
      $s6 = "%DestFolder%" fullword wide ascii

Detection condition:
uint16(0) == 0xcfd0 and filesize < 3000KB and 2 of them

Full rule:
rule OilRig_ISMAgent_Campaign_Samples1 {
   meta:
      description = "Detects OilRig malware from Unit 42 report in October 2017"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/JQVfFP"
      date = "2017-10-18"
      hash1 = "119c64a8b35bd626b3ea5f630d533b2e0e7852a4c59694125ff08f9965b5f9cc"
      hash2 = "0ccb2117c34e3045a4d2c0d193f1963c8c0e8566617ed0a561546c932d1a5c0c"
      id = "237fe7af-a2ab-51ae-bc96-3af46b08622a"
   strings:
      $s1 = "###$$$TVqQAAMAAAAEAAAA" ascii
      $s2 = "C:\\Users\\J-Win-7-32-Vm\\Desktop\\error.jpg" fullword wide
      $s3 = "$DATA = [System.Convert]::FromBase64String([IO.File]::ReadAllText('%Base%'));[io.file]::WriteAllBytes(" ascii
      $s4 = " /c echo powershell > " fullword wide ascii
      $s5 = "\\Libraries\\servicereset.exe" wide
      $s6 = "%DestFolder%" fullword wide ascii
   condition:
      uint16(0) == 0xcfd0 and filesize < 3000KB and 2 of them
}
YARA Detection Rule: OilRig_ISMAgent_Campaign_Samples2
Repository: Neo23x0/signature-base
Detects: Detects OilRig malware from Unit 42 report in October 2017
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/JQVfFP

Pattern signatures:
$x1 = "PolicyConverter.exe" fullword wide
      $x2 = "SrvHealth.exe" fullword wide
      $x3 = "srvBS.txt" fullword wide

      $s1 = "{a3538ba3-5cf7-43f0-bc0e-9b53a98e1643}, PublicKeyToken=3e56350693f7355e" fullword wide
      $s2 = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 700KB and ( 2 of ($x*) or 3 of them )

Full rule:
rule OilRig_ISMAgent_Campaign_Samples2 {
   meta:
      description = "Detects OilRig malware from Unit 42 report in October 2017"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/JQVfFP"
      date = "2017-10-18"
      hash1 = "fcad263d0fe2b418db05f47d4036f0b42aaf201c9b91281dfdcb3201b298e4f4"
      hash2 = "33c187cfd9e3b68c3089c27ac64a519ccc951ccb3c74d75179c520f54f11f647"
      id = "08771b23-1d0e-5da7-b42c-005ed257e2d1"
   strings:
      $x1 = "PolicyConverter.exe" fullword wide
      $x2 = "SrvHealth.exe" fullword wide
      $x3 = "srvBS.txt" fullword wide

      $s1 = "{a3538ba3-5cf7-43f0-bc0e-9b53a98e1643}, PublicKeyToken=3e56350693f7355e" fullword wide
      $s2 = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 700KB and ( 2 of ($x*) or 3 of them )
}
YARA Detection Rule: OilRig_ISMAgent_Campaign_Samples3
Repository: Neo23x0/signature-base
Detects: Detects OilRig malware from Unit 42 report in October 2017
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/JQVfFP

Pattern signatures:
$x1 = "cmd /c schtasks /query /tn TimeUpdate > NUL 2>&1" ascii
      $x2 = "schtasks /create /sc minute /mo 0002 /tn TimeUpdate /tr" fullword ascii
      $x3 = "-c  SampleDomain.com -m scheduleminutes" fullword ascii
      $x4 = ".ntpupdateserver.com" fullword ascii
      $x5 = ".msoffice365update.com" fullword ascii

      $s1 = "out.exe" fullword ascii
      $s2 = "\\Win32Project1\\Release\\Win32Project1.pdb" ascii
      $s3 = "C:\\windows\\system32\\cmd.exe /c (" ascii
      $s4 = "Content-Disposition: form-data; name=\"file\"; filename=\"a.a\"" fullword ascii
      $s5 = "Agent configured successfully" fullword ascii
      $s6 = "\\runlog*" ascii
      $s7 = "can not specify username!!" fullword ascii
      $s8 = "Agent can not be configured" fullword ascii
      $s9 = "%08lX%04hX%04hX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX" fullword ascii
      $s10 = "!!! can not create output file !!!" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 400KB and (
         pe.imphash() == "538805ecd776b9a42e71aebf94fde1b1" or
         pe.imphash() == "861ac226fbe8c99a2c43ff451e95da97" or
         ( 1 of ($x*) or 3 of them )
      )

Full rule:
rule OilRig_ISMAgent_Campaign_Samples3 {
   meta:
      description = "Detects OilRig malware from Unit 42 report in October 2017"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/JQVfFP"
      date = "2017-10-18"
      hash1 = "a9f1375da973b229eb649dc3c07484ae7513032b79665efe78c0e55a6e716821"
      id = "e26510bd-d183-566a-a185-ebed7a81401c"
   strings:
      $x1 = "cmd /c schtasks /query /tn TimeUpdate > NUL 2>&1" ascii
      $x2 = "schtasks /create /sc minute /mo 0002 /tn TimeUpdate /tr" fullword ascii
      $x3 = "-c  SampleDomain.com -m scheduleminutes" fullword ascii
      $x4 = ".ntpupdateserver.com" fullword ascii
      $x5 = ".msoffice365update.com" fullword ascii

      $s1 = "out.exe" fullword ascii
      $s2 = "\\Win32Project1\\Release\\Win32Project1.pdb" ascii
      $s3 = "C:\\windows\\system32\\cmd.exe /c (" ascii
      $s4 = "Content-Disposition: form-data; name=\"file\"; filename=\"a.a\"" fullword ascii
      $s5 = "Agent configured successfully" fullword ascii
      $s6 = "\\runlog*" ascii
      $s7 = "can not specify username!!" fullword ascii
      $s8 = "Agent can not be configured" fullword ascii
      $s9 = "%08lX%04hX%04hX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX" fullword ascii
      $s10 = "!!! can not create output file !!!" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 400KB and (
         pe.imphash() == "538805ecd776b9a42e71aebf94fde1b1" or
         pe.imphash() == "861ac226fbe8c99a2c43ff451e95da97" or
         ( 1 of ($x*) or 3 of them )
      )
}