deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: apt_sofacy_xtunnel
Repository: Neo23x0/signature-base
Detects: Sofacy Malware - German Bundestag
Author: Claudio Guarnieri

Pattern signatures:
$xaps = ":\\PROJECT\\XAPS_"
        $variant11 = "XAPS_OBJECTIVE.dll" $variant12 = "start"
        $variant21 = "User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0"
        $variant22 = "is you live?"
        $mix1 = "176.31.112.10"
        $mix2 = "error in select, errno %d" $mix3 = "no msg"
        $mix4 = "is you live?"
        $mix5 = "127.0.0.1"
        $mix6 = "err %d"
        $mix7 = "i`m wait"
        $mix8 = "hello"
        $mix9 = "OpenSSL 1.0.1e 11 Feb 2013" $mix10 = "Xtunnel.exe"

Detection condition:
((uint16(0) == 0x5A4D) or (uint16(0) == 0xCFD0)) and (($xaps) or (all of ($variant1*)) or (all of ($variant2*)) or (6 of ($mix*)))

Full rule:
rule apt_sofacy_xtunnel {
    meta:
        author = "Claudio Guarnieri"
        description = "Sofacy Malware - German Bundestag"
        score = 75
        id = "aef091b5-cedf-5443-ab61-8b2dbc7e77fd"
    strings:
        $xaps = ":\\PROJECT\\XAPS_"
        $variant11 = "XAPS_OBJECTIVE.dll" $variant12 = "start"
        $variant21 = "User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0"
        $variant22 = "is you live?"
        $mix1 = "176.31.112.10"
        $mix2 = "error in select, errno %d" $mix3 = "no msg"
        $mix4 = "is you live?"
        $mix5 = "127.0.0.1"
        $mix6 = "err %d"
        $mix7 = "i`m wait"
        $mix8 = "hello"
        $mix9 = "OpenSSL 1.0.1e 11 Feb 2013" $mix10 = "Xtunnel.exe"
    condition:
        ((uint16(0) == 0x5A4D) or (uint16(0) == 0xCFD0)) and (($xaps) or (all of ($variant1*)) or (all of ($variant2*)) or (6 of ($mix*)))
}
YARA Detection Rule: Winexe_RemoteExec
Repository: Neo23x0/signature-base
Detects: Winexe tool for remote execution (also used by Sofacy group)
Author: Florian Roth (Nextron Systems), Robert Simmons
Reference: http://dokumente.linksfraktion.de/inhalt/report-orig.pdf

Pattern signatures:
$s1 = "error Cannot LogonUser(%s,%s,%s) %d" ascii fullword
      $s2 = "error Cannot ImpersonateNamedPipeClient %d" ascii fullword
      $s3 = "\\\\.\\pipe\\ahexec" fullword ascii
      $s4 = "\\\\.\\pipe\\wmcex" fullword ascii
      $s5 = "implevel" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 115KB and (
      3 of them or
      pe.imphash() == "2f8a475933ac82b8e09eaf26b396b54d"
   )

Full rule:
rule Winexe_RemoteExec {
   meta:
      description = "Winexe tool for remote execution (also used by Sofacy group)"
      author = "Florian Roth (Nextron Systems), Robert Simmons"
      reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
      date = "2015-06-19"
      modified = "2021-02-11"
      hash1 = "5130f600cd9a9cdc82d4bad938b20cbd2f699aadb76e7f3f1a93602330d9997d"
      hash2 = "d19dfdbe747e090c5aa2a70cc10d081ac1aa88f360c3f378288a3651632c4429"
      score = 70
      id = "5079557a-0461-5b04-b0f2-4265bf7ec041"
   strings:
      $s1 = "error Cannot LogonUser(%s,%s,%s) %d" ascii fullword
      $s2 = "error Cannot ImpersonateNamedPipeClient %d" ascii fullword
      $s3 = "\\\\.\\pipe\\ahexec" fullword ascii
      $s4 = "\\\\.\\pipe\\wmcex" fullword ascii
      $s5 = "implevel" fullword ascii
   condition:
   uint16(0) == 0x5a4d and filesize < 115KB and (
      3 of them or
      pe.imphash() == "2f8a475933ac82b8e09eaf26b396b54d"
   )
}
YARA Detection Rule: Sofacy_Mal2
Repository: Neo23x0/signature-base
Detects: Sofacy Group Malware Sample 2
Author: Florian Roth (Nextron Systems)
Reference: http://dokumente.linksfraktion.de/inhalt/report-orig.pdf

Pattern signatures:
$x1 = "PROJECT\\XAPS_OBJECTIVE_DLL\\" ascii
        $x2 = "XAPS_OBJECTIVE.dll" fullword ascii

        $s1 = "i`m wait" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and ( 1 of ($x*) ) and $s1

Full rule:
rule Sofacy_Mal2 {
    meta:
        description = "Sofacy Group Malware Sample 2"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
        date = "2015-06-19"
        hash = "566ab945f61be016bfd9e83cc1b64f783b9b8deb891e6d504d3442bc8281b092"
        score = 70
        id = "1547cc67-7d7c-5ec9-816c-15b7d523376a"
    strings:
        $x1 = "PROJECT\\XAPS_OBJECTIVE_DLL\\" ascii
        $x2 = "XAPS_OBJECTIVE.dll" fullword ascii

        $s1 = "i`m wait" fullword ascii
    condition:
        uint16(0) == 0x5a4d and ( 1 of ($x*) ) and $s1
}
YARA Detection Rule: Sofacy_Mal3
Repository: Neo23x0/signature-base
Detects: Sofacy Group Malware Sample 3
Author: Florian Roth (Nextron Systems)
Reference: http://dokumente.linksfraktion.de/inhalt/report-orig.pdf

Pattern signatures:
$s1 = "shell\\open\\command=\"System Volume Information\\USBGuard.exe\" install" fullword ascii
        $s2 = ".?AVAgentModuleRemoteKeyLogger@@" fullword ascii
        $s3 = "<font size=4 color=red>process isn't exist</font>" fullword ascii
        $s4 = "<font size=4 color=red>process is exist</font>" fullword ascii
        $s5 = ".winnt.check-fix.com" ascii
        $s6 = ".update.adobeincorp.com" ascii
        $s7 = ".microsoft.checkwinframe.com" ascii
        $s8 = "adobeincorp.com" fullword wide
        $s9 = "# EXC: HttpSender - Cannot create Get Channel!" fullword ascii

        $x1 = "User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:20.0) Gecko/20100101 Firefox/" wide
        $x2 = "User-Agent: Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/2" wide
        $x3 = "C:\\Windows\\System32\\cmd.exe" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and (
            2 of ($s*) or
            ( 1 of ($s*) and all of ($x*) )
        )

Full rule:
rule Sofacy_Mal3 {
    meta:
        description = "Sofacy Group Malware Sample 3"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
        date = "2015-06-19"
        modified = "2023-01-06"
        hash = "5f6b2a0d1d966fc4f1ed292b46240767f4acb06c13512b0061b434ae2a692fa1"
        score = 70
        id = "67d002ef-4ed9-54ce-a6ef-49b7f3b951e2"
    strings:
        $s1 = "shell\\open\\command=\"System Volume Information\\USBGuard.exe\" install" fullword ascii
        $s2 = ".?AVAgentModuleRemoteKeyLogger@@" fullword ascii
        $s3 = "<font size=4 color=red>process isn't exist</font>" fullword ascii
        $s4 = "<font size=4 color=red>process is exist</font>" fullword ascii
        $s5 = ".winnt.check-fix.com" ascii
        $s6 = ".update.adobeincorp.com" ascii
        $s7 = ".microsoft.checkwinframe.com" ascii
        $s8 = "adobeincorp.com" fullword wide
        $s9 = "# EXC: HttpSender - Cannot create Get Channel!" fullword ascii

        $x1 = "User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:20.0) Gecko/20100101 Firefox/" wide
        $x2 = "User-Agent: Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/2" wide
        $x3 = "C:\\Windows\\System32\\cmd.exe" fullword wide
    condition:
        uint16(0) == 0x5a4d and filesize < 300KB and (
            2 of ($s*) or
            ( 1 of ($s*) and all of ($x*) )
        )
}
YARA Detection Rule: Sofacy_Bundestag_Batch
Repository: Neo23x0/signature-base
Detects: Sofacy Bundestags APT Batch Script
Author: Florian Roth (Nextron Systems)
Reference: http://dokumente.linksfraktion.de/inhalt/report-orig.pdf

Pattern signatures:
$s1 = "for %%G in (.pdf, .xls, .xlsx, .doc, .docx)" ascii
        $s2 = "cmd /c copy"
        $s3 = "forfiles"

Detection condition:
filesize < 10KB and 2 of them

Full rule:
rule Sofacy_Bundestag_Batch {
    meta:
        description = "Sofacy Bundestags APT Batch Script"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
        date = "2015-06-19"
        score = 70
        id = "869dafec-1387-5640-b608-b84cf0d43342"
    strings:
        $s1 = "for %%G in (.pdf, .xls, .xlsx, .doc, .docx)" ascii
        $s2 = "cmd /c copy"
        $s3 = "forfiles"
    condition:
        filesize < 10KB and 2 of them
}
YARA Detection Rule: GRIZZLY_STEPPE_Malware_1
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file HRDG022184_certclint.dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/WVflzO

Pattern signatures:
$s1 = "S:\\Lidstone\\renewing\\HA\\disable\\In.pdb" fullword ascii
      $s2 = "Repeat last find command)Replace specific text with different text" fullword wide
      $s3 = "l\\Processor(0)\\% Processor Time" fullword wide
      $s6 = "Self Process" fullword wide
      $s7 = "Default Process" fullword wide
      $s8 = "Star Polk.exe" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and 4 of them )

Full rule:
rule GRIZZLY_STEPPE_Malware_1 {
   meta:
      description = "Auto-generated rule - file HRDG022184_certclint.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/WVflzO"
      date = "2016-12-29"
      hash1 = "9f918fb741e951a10e68ce6874b839aef5a26d60486db31e509f8dcaa13acec5"
      id = "7239a5f3-9c29-57d7-be95-946d14039353"
   strings:
      $s1 = "S:\\Lidstone\\renewing\\HA\\disable\\In.pdb" fullword ascii
      $s2 = "Repeat last find command)Replace specific text with different text" fullword wide
      $s3 = "l\\Processor(0)\\% Processor Time" fullword wide
      $s6 = "Self Process" fullword wide
      $s7 = "Default Process" fullword wide
      $s8 = "Star Polk.exe" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and 4 of them )
}
YARA Detection Rule: GRIZZLY_STEPPE_Malware_2
Repository: Neo23x0/signature-base
Detects: Auto-generated rule
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/WVflzO

Pattern signatures:
$x1 = "GoogleCrashReport.dll" fullword ascii

      $s1 = "CrashErrors" fullword ascii
      $s2 = "CrashSend" fullword ascii
      $s3 = "CrashAddData" fullword ascii
      $s4 = "CrashCleanup" fullword ascii
      $s5 = "CrashInit" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and $x1 ) or ( all of them )

Full rule:
rule GRIZZLY_STEPPE_Malware_2 {
   meta:
      description = "Auto-generated rule"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/WVflzO"
      date = "2016-12-29"
      hash1 = "9acba7e5f972cdd722541a23ff314ea81ac35d5c0c758eb708fb6e2cc4f598a0"
      hash2 = "55058d3427ce932d8efcbe54dccf97c9a8d1e85c767814e34f4b2b6a6b305641"
      id = "37cfba67-af85-5efe-9b07-9f1e5d9f9195"
   strings:
      $x1 = "GoogleCrashReport.dll" fullword ascii

      $s1 = "CrashErrors" fullword ascii
      $s2 = "CrashSend" fullword ascii
      $s3 = "CrashAddData" fullword ascii
      $s4 = "CrashCleanup" fullword ascii
      $s5 = "CrashInit" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 1000KB and $x1 ) or ( all of them )
}
YARA Detection Rule: PAS_TOOL_PHP_WEB_KIT_mod
Repository: Neo23x0/signature-base
Detects: Detects PAS Tool PHP Web Kit
Author: US CERT - modified by Florian Roth due to performance reasons
Reference: https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity

Pattern signatures:
$php = "<?php"
      $base64decode1 = "='base'.("
      $strreplace = "str_replace(\"\\n\", ''"
      $md5 = ".substr(md5(strrev("
      $gzinflate = "gzinflate"
      $cookie = "_COOKIE"
      $isset = "isset"

Detection condition:
uint32(0) == 0x68703f3c and
      $php at 0 and
      (filesize > 10KB and filesize < 30KB) and
      #cookie == 2 and
      #isset == 3 and
      all of them

Full rule:
rule PAS_TOOL_PHP_WEB_KIT_mod {
   meta:
      description = "Detects PAS Tool PHP Web Kit"
      reference = "https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity"
      author = "US CERT - modified by Florian Roth due to performance reasons"
      date = "2016/12/29"
      id = "6bc75e44-7784-5e48-9bbc-052d84ebee83"
   strings:
      $php = "<?php"
      $base64decode1 = "='base'.("
      $strreplace = "str_replace(\"\\n\", ''"
      $md5 = ".substr(md5(strrev("
      $gzinflate = "gzinflate"
      $cookie = "_COOKIE"
      $isset = "isset"
   condition:
      uint32(0) == 0x68703f3c and
      $php at 0 and
      (filesize > 10KB and filesize < 30KB) and
      #cookie == 2 and
      #isset == 3 and
      all of them
}
YARA Detection Rule: WebShell_PHP_Web_Kit_v3
Repository: Neo23x0/signature-base
Detects: Detects PAS Tool PHP Web Kit
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/wordfence/grizzly

Pattern signatures:
$php = "<?php $"
      $php2 = "@assert(base64_decode($_REQUEST["

      $s1 = "(str_replace(\"\\n\", '', '"
      $s2 = "(strrev($" ascii
      $s3 = "de'.'code';" ascii

Detection condition:
( ( uint32(0) == 0x68703f3c and $php at 0 ) or $php2 ) and
      filesize > 8KB and filesize < 100KB and
      all of ($s*)

Full rule:
rule WebShell_PHP_Web_Kit_v3 {
   meta:
      description = "Detects PAS Tool PHP Web Kit"
      reference = "https://github.com/wordfence/grizzly"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "2016/01/01"
      id = "dc5fa2c9-3e1e-594d-be4f-141e1f4915f1"
   strings:
      $php = "<?php $"
      $php2 = "@assert(base64_decode($_REQUEST["

      $s1 = "(str_replace(\"\\n\", '', '"
      $s2 = "(strrev($" ascii
      $s3 = "de'.'code';" ascii
   condition:
      ( ( uint32(0) == 0x68703f3c and $php at 0 ) or $php2 ) and
      filesize > 8KB and filesize < 100KB and
      all of ($s*)
}
YARA Detection Rule: WebShell_PHP_Web_Kit_v4
Repository: Neo23x0/signature-base
Detects: Detects PAS Tool PHP Web Kit
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/wordfence/grizzly

Pattern signatures:
$php = "<?php $"

      $s1 = "(StR_ReplAcE(\"\\n\",'',"
      $s2 = ";if(PHP_VERSION<'5'){" ascii
      $s3 = "=SuBstr_rePlACe(" ascii

Detection condition:
uint32(0) == 0x68703f3c and 
      $php at 0 and
      filesize > 8KB and filesize < 100KB and
      2 of ($s*)

Full rule:
rule WebShell_PHP_Web_Kit_v4 {
   meta:
      description = "Detects PAS Tool PHP Web Kit"
      reference = "https://github.com/wordfence/grizzly"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "2016/01/01"
      id = "a5f915cd-b9c5-5cd3-b0a2-c15f6124737a"
   strings:
      $php = "<?php $"

      $s1 = "(StR_ReplAcE(\"\\n\",'',"
      $s2 = ";if(PHP_VERSION<'5'){" ascii
      $s3 = "=SuBstr_rePlACe(" ascii
   condition:
      uint32(0) == 0x68703f3c and 
      $php at 0 and
      filesize > 8KB and filesize < 100KB and
      2 of ($s*)
}
YARA Detection Rule: APT_APT29_wellmess_dotnet_unique_strings
Repository: Neo23x0/signature-base
Detects: Rule to detect WellMess .NET samples based on unique strings and function/variable names
Author: NCSC
Reference: https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development

Pattern signatures:
$s1 = "HealthInterval" wide
      $s2 = "Hello from Proxy" wide 
      $s3 = "Start bot:" wide
      $s4 = "FromNormalToBase64" ascii 
      $s5 = "FromBase64ToNormal" ascii 
      $s6 = "WellMess" ascii

Detection condition:
uint16(0) == 0x5a4d and uint16(uint16(0x3c)) == 0x4550 and 3 of them

Full rule:
rule APT_APT29_wellmess_dotnet_unique_strings {
   meta:
      description = "Rule to detect WellMess .NET samples based on unique strings and function/variable names"
      author = "NCSC"
      reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
      hash = "2285a264ffab59ab5a1eb4e2b9bcab9baf26750b6c551ee3094af56a4442ac41"
      id = "7a058ec7-f795-5226-b511-ff469a969ee6"
   strings:
      $s1 = "HealthInterval" wide
      $s2 = "Hello from Proxy" wide 
      $s3 = "Start bot:" wide
      $s4 = "FromNormalToBase64" ascii 
      $s5 = "FromBase64ToNormal" ascii 
      $s6 = "WellMess" ascii
   condition:
      uint16(0) == 0x5a4d and uint16(uint16(0x3c)) == 0x4550 and 3 of them
}
YARA Detection Rule: APT_APT29_sorefang_encryption_key_schedule
Repository: Neo23x0/signature-base
Detects: Rule to detect SoreFang based on the key schedule used for encryption
Author: NCSC
Reference: https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development

Pattern signatures:
$ = { C7 05 ?? ?? ?? ?? 63 51 E1 B7 B8 ?? ?? ?? ?? 8B 48 
            FC 81 E9 47 86 C8 61 89 08 83 C0 04 3D ?? ?? ?? ?? 
            7E EB 33 D2 33 C9 B8 2C 00 00 00 89 55 D4 33 F6 89 
            4D D8 33 DB 3B F8 0F 4F C7 8D 04 40 89 45 D0 83 F8 
            01 7C 4F 0F 1F 80 00 00 00 00 }

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and any of them

Full rule:
rule APT_APT29_sorefang_encryption_key_schedule { 
   meta:
      description = "Rule to detect SoreFang based on the key schedule used for encryption"
      author = "NCSC"
      reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
      hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
      id = "8d89edc1-a9fc-5155-9dc2-8d7f952f90d1"
   strings:
      $ = { C7 05 ?? ?? ?? ?? 63 51 E1 B7 B8 ?? ?? ?? ?? 8B 48 
            FC 81 E9 47 86 C8 61 89 08 83 C0 04 3D ?? ?? ?? ?? 
            7E EB 33 D2 33 C9 B8 2C 00 00 00 89 55 D4 33 F6 89 
            4D D8 33 DB 3B F8 0F 4F C7 8D 04 40 89 45 D0 83 F8 
            01 7C 4F 0F 1F 80 00 00 00 00 }
   condition:
      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and any of them 
}
YARA Detection Rule: APT_APT29_sorefang_encryption_key_2b62
Repository: Neo23x0/signature-base
Detects: Rule to detect SoreFang based on hardcoded encryption key
Author: NCSC
Reference: https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development

Pattern signatures:
$ = "2b6233eb3e872ff78988f4a8f3f6a3ba"

Detection condition:
( uint16(0) == 0x5A4D and uint16(uint32(0x3c) ) == 0x4550) 
      and any of them

Full rule:
rule APT_APT29_sorefang_encryption_key_2b62 {
  meta:
      description = "Rule to detect SoreFang based on hardcoded encryption key"
      author = "NCSC"
      reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
      hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
      id = "9a7abad7-1cfa-52c8-9416-47cb80486714"
   strings:
      $ = "2b6233eb3e872ff78988f4a8f3f6a3ba"
   condition:
      ( uint16(0) == 0x5A4D and uint16(uint32(0x3c) ) == 0x4550) 
      and any of them 
}
YARA Detection Rule: APT_APT29_sorefang_directory_enumeration_output_strings
Repository: Neo23x0/signature-base
Detects: Rule to detect SoreFang based on formatted string output for directory enumeration
Author: NCSC
Reference: https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development

Pattern signatures:
$ = "----------All usres directory----------" 
      $ = "----------Desktop directory----------"
      $ = "----------Documents directory----------"

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) 
      and 2 of them

Full rule:
rule APT_APT29_sorefang_directory_enumeration_output_strings { 
   meta:
      description = "Rule to detect SoreFang based on formatted string output for directory enumeration"
      author = "NCSC"
      reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
      hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
      id = "e24dbda1-3d43-52a7-9249-70a648f4913e"
   strings:
      $ = "----------All usres directory----------" 
      $ = "----------Desktop directory----------"
      $ = "----------Documents directory----------"
   condition:
      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) 
      and 2 of them 
}
YARA Detection Rule: APT_APT29_sorefang_command_elem_cookie_ga_boundary_string
Repository: Neo23x0/signature-base
Detects: Rule to detect SoreFang based on scheduled task element and Cookie header/boundary strings
Author: NCSC
Reference: https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development

Pattern signatures:
$ = "<Command>" wide
      $ = "Cookie:_ga="
      $ = "-----[PII_REDACTED][PII_REDACTED]1610575"

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) 
      and 2 of them

Full rule:
rule APT_APT29_sorefang_command_elem_cookie_ga_boundary_string { 
   meta:
      description = "Rule to detect SoreFang based on scheduled task element and Cookie header/boundary strings"
      author = "NCSC"
      reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
      hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
      id = "3c6ffbad-9b39-5518-aa66-d76531ddb9ea"
   strings:
      $ = "<Command>" wide
      $ = "Cookie:_ga="
      $ = "-----[PII_REDACTED][PII_REDACTED]1610575"
   condition:
      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) 
      and 2 of them 
}
YARA Detection Rule: APT_APT29_sorefang_encryption_round_function
Repository: Neo23x0/signature-base
Detects: Rule to detect SoreFang based on the encryption round function
Author: NCSC
Reference: https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development

Pattern signatures:
$ = { 8A E9 8A FB 8A 5D 0F 02 C9 88 45 0F FE C1 0F BE C5 88 6D F3 8D
            14 45 01 00 00 00 0F AF D0 0F BE C5 0F BE C9 0F AF C8 C1 FA 1B C0 E1 05 0A D1 8B 4D EC 0F BE C1 89 55 E4 8D 14 45 01 00 00 00 0F AF D0 8B C1}

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550)
      and any of them

Full rule:
rule APT_APT29_sorefang_encryption_round_function { 
   meta:
      description = "Rule to detect SoreFang based on the encryption round function"
      author = "NCSC"
      reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
      hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
      id = "0be1c084-c8df-5920-a320-90364a7fb542"
   strings:
      $ = { 8A E9 8A FB 8A 5D 0F 02 C9 88 45 0F FE C1 0F BE C5 88 6D F3 8D
            14 45 01 00 00 00 0F AF D0 0F BE C5 0F BE C9 0F AF C8 C1 FA 1B C0 E1 05 0A D1 8B 4D EC 0F BE C1 89 55 E4 8D 14 45 01 00 00 00 0F AF D0 8B C1}
   condition:
      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550)
      and any of them 
}
YARA Detection Rule: APT_APT29_sorefang_add_random_commas_spaces
Repository: Neo23x0/signature-base
Detects: Rule to detect SoreFang based on function that adds commas and spaces
Author: NCSC
Reference: https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development

Pattern signatures:
$ = { E8 ?? ?? ?? ?? B9 06 00 00 00 99 F7 F9 8B CE 83 FA 04 7E 09 6A
            02 68 ?? ?? ?? ?? EB 07 6A 01 68 }

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) 
      and any of them

Full rule:
rule APT_APT29_sorefang_add_random_commas_spaces { 
   meta:
      description = "Rule to detect SoreFang based on function that adds commas and spaces"
      author = "NCSC"
      reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
      hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
      id = "9a89c619-6309-500f-b4dc-c8a3e8fc4417"
   strings:
      $ = { E8 ?? ?? ?? ?? B9 06 00 00 00 99 F7 F9 8B CE 83 FA 04 7E 09 6A
            02 68 ?? ?? ?? ?? EB 07 6A 01 68 } 
   condition:
      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) 
      and any of them
}