deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: xssshell_default
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file default.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s3 = "If ProxyData <> \"\" Then ProxyData = Replace(ProxyData, DATA_SEPERATOR, \"<br />\")"

Detection condition:
all of them

Full rule:
rule xssshell_default {
	meta:
		description = "Webshells Auto-generated - file default.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "d156782ae5e0b3724de3227b42fcaf2f"
		id = "1c221572-4cb5-5806-a856-0f857dba230a"
	strings:
		$s3 = "If ProxyData <> \"\" Then ProxyData = Replace(ProxyData, DATA_SEPERATOR, \"<br />\")"
	condition:
		all of them
}
YARA Detection Rule: EditServer_2
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file EditServer.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "@HOTMAIL.COM"
		$s1 = "Press Any Ke"
		$s3 = "glish MenuZ"

Detection condition:
all of them

Full rule:
rule EditServer_2 {
	meta:
		description = "Webshells Auto-generated - file EditServer.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "5c1f25a4d206c83cdfb006b3eb4c09ba"
		id = "bd254bd9-fd23-5807-9347-2a559089b7c5"
	strings:
		$s0 = "@HOTMAIL.COM"
		$s1 = "Press Any Ke"
		$s3 = "glish MenuZ"
	condition:
		all of them
}
YARA Detection Rule: by064cli
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file by064cli.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s7 = "packet dropped,redirecting"
		$s9 = "input the password(the default one is 'by')"

Detection condition:
all of them

Full rule:
rule by064cli {
	meta:
		description = "Webshells Auto-generated - file by064cli.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "10e0dff366968b770ae929505d2a9885"
		id = "9ea88f0c-9275-5567-a4d9-0545de8044d1"
	strings:
		$s7 = "packet dropped,redirecting"
		$s9 = "input the password(the default one is 'by')"
	condition:
		all of them
}
YARA Detection Rule: Mithril_dllTest
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file dllTest.dll
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "please enter the password:"
		$s3 = "\\dllTest.pdb"

Detection condition:
all of them

Full rule:
rule Mithril_dllTest {
	meta:
		description = "Webshells Auto-generated - file dllTest.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "a8d25d794d8f08cd4de0c3d6bf389e6d"
		id = "59a6bfb6-c099-56cd-b40e-3e92ea0eb7d3"
	strings:
		$s0 = "please enter the password:"
		$s3 = "\\dllTest.pdb"
	condition:
		all of them
}
YARA Detection Rule: peek_a_boo
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file peek-a-boo.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "__vbaHresultCheckObj"
		$s1 = "\\VB\\VB5.OLB"
		$s2 = "capGetDriverDescriptionA"
		$s3 = "__vbaExceptHandler"
		$s4 = "EVENT_SINK_Release"
		$s8 = "__vbaErrorOverflow"

Detection condition:
all of them

Full rule:
rule peek_a_boo {
	meta:
		description = "Webshells Auto-generated - file peek-a-boo.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "aca339f60d41fdcba83773be5d646776"
		id = "f6ca33b5-e37f-5124-a193-a3056c559314"
	strings:
		$s0 = "__vbaHresultCheckObj"
		$s1 = "\\VB\\VB5.OLB"
		$s2 = "capGetDriverDescriptionA"
		$s3 = "__vbaExceptHandler"
		$s4 = "EVENT_SINK_Release"
		$s8 = "__vbaErrorOverflow"
	condition:
		all of them
}
YARA Detection Rule: fmlibraryv3
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file fmlibraryv3.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s3 = "ExeNewRs.CommandText = \"UPDATE \" & tablename & \" SET \" & ExeNewRsValues & \" WHER"

Detection condition:
all of them

Full rule:
rule fmlibraryv3 {
	meta:
		description = "Webshells Auto-generated - file fmlibraryv3.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "c34c248fed6d5a20d8203924a2088acc"
		id = "9b8ef79d-80bb-5a05-91e6-0f2bc3fd3068"
	strings:
		$s3 = "ExeNewRs.CommandText = \"UPDATE \" & tablename & \" SET \" & ExeNewRsValues & \" WHER"
	condition:
		all of them
}
YARA Detection Rule: Debug_dllTest_2
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file dllTest.dll
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s4 = "\\Debug\\dllTest.pdb"
		$s5 = "--list the services in the computer"

Detection condition:
all of them

Full rule:
rule Debug_dllTest_2 {
	meta:
		description = "Webshells Auto-generated - file dllTest.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "1b9e518aaa62b15079ff6edb412b21e9"
		id = "cf81e3de-513c-584d-bc37-6504e91b170c"
	strings:
		$s4 = "\\Debug\\dllTest.pdb"
		$s5 = "--list the services in the computer"
	condition:
		all of them
}
YARA Detection Rule: connector
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file connector.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s2 = "If ( AttackID = BROADCAST_ATTACK )"
		$s4 = "Add UNIQUE ID for victims / zombies"

Detection condition:
all of them

Full rule:
rule connector {
	meta:
		description = "Webshells Auto-generated - file connector.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "3ba1827fca7be37c8296cd60be9dc884"
		id = "e46026bc-c570-5057-a132-5a459c959a69"
	strings:
		$s2 = "If ( AttackID = BROADCAST_ATTACK )"
		$s4 = "Add UNIQUE ID for victims / zombies"
	condition:
		all of them
}
YARA Detection Rule: shelltools_g0t_root_HideRun
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file HideRun.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Usage -- hiderun [AppName]"
		$s7 = "PVAX SW, Alexey A. Popoff, Moscow, 1997."

Detection condition:
all of them

Full rule:
rule shelltools_g0t_root_HideRun {
	meta:
		description = "Webshells Auto-generated - file HideRun.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "45436d9bfd8ff94b71eeaeb280025afe"
		id = "dd71dbef-5b5d-5976-8b95-0f202a4b4795"
	strings:
		$s0 = "Usage -- hiderun [AppName]"
		$s7 = "PVAX SW, Alexey A. Popoff, Moscow, 1997."
	condition:
		all of them
}
YARA Detection Rule: PHP_Shell_v1_7
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file PHP_Shell_v1.7.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s8 = "<title>[ADDITINAL TITTLE]-phpShell by:[YOURNAME]"

Detection condition:
all of them

Full rule:
rule PHP_Shell_v1_7 {
	meta:
		description = "Webshells Auto-generated - file PHP_Shell_v1.7.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "b5978501c[PII_REDACTED]b4ca6fb77cba5"
		id = "7eb69ac3-90bb-5a44-8dcd-e71f5edcf18f"
	strings:
		$s8 = "<title>[ADDITINAL TITTLE]-phpShell by:[YOURNAME]"
	condition:
		all of them
}
YARA Detection Rule: xssshell_save
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file save.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s4 = "RawCommand = Command & COMMAND_SEPERATOR & Param & COMMAND_SEPERATOR & AttackID"
		$s5 = "VictimID = fm_NStr(Victims(i))"

Detection condition:
all of them

Full rule:
rule xssshell_save {
	meta:
		description = "Webshells Auto-generated - file save.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "865da1b3974e940936fe38e8e1964980"
		id = "f33c7559-e2f7-5223-a0e9-4e1d3bc7f080"
	strings:
		$s4 = "RawCommand = Command & COMMAND_SEPERATOR & Param & COMMAND_SEPERATOR & AttackID"
		$s5 = "VictimID = fm_NStr(Victims(i))"
	condition:
		all of them
}
YARA Detection Rule: screencap
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file screencap.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "GetDIBColorTable"
		$s1 = "Screen.bmp"
		$s2 = "CreateDCA"

Detection condition:
all of them

Full rule:
rule screencap {
	meta:
		description = "Webshells Auto-generated - file screencap.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "51139091dea7a9418a50f2712ea72aa6"
		id = "0c1b71d3-ad54-5230-b1ab-971647e76139"
	strings:
		$s0 = "GetDIBColorTable"
		$s1 = "Screen.bmp"
		$s2 = "CreateDCA"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_phpinj_2
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file phpinj.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s9 = "<? system(\\$_GET[cpc]);exit; ?>' ,0 ,0 ,0 ,0 INTO"

Detection condition:
all of them

Full rule:
rule FSO_s_phpinj_2 {
	meta:
		description = "Webshells Auto-generated - file phpinj.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "dd39d17e9baca0363cc1c3664e608929"
		id = "db8f835e-eb13-50f3-a60b-7d8ffcaa5eaa"
	strings:
		$s9 = "<? system(\\$_GET[cpc]);exit; ?>' ,0 ,0 ,0 ,0 INTO"
	condition:
		all of them
}
YARA Detection Rule: ZXshell2_0_rar_Folder_zxrecv
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file zxrecv.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "RyFlushBuff"
		$s1 = "teToWideChar^FiYP"
		$s2 = "mdesc+8F D"
		$s3 = "\\von76std"
		$s4 = "5pur+virtul"
		$s5 = "- Kablto io"
		$s6 = "ac#f{lowi8a"

Detection condition:
all of them

Full rule:
rule ZXshell2_0_rar_Folder_zxrecv {
	meta:
		description = "Webshells Auto-generated - file zxrecv.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "5d3d12a39f41d51341ef4cb7ce69d30f"
		id = "9d36541f-dd55-5385-8e2b-598ad78bdf73"
	strings:
		$s0 = "RyFlushBuff"
		$s1 = "teToWideChar^FiYP"
		$s2 = "mdesc+8F D"
		$s3 = "\\von76std"
		$s4 = "5pur+virtul"
		$s5 = "- Kablto io"
		$s6 = "ac#f{lowi8a"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_ajan
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file ajan.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s4 = "entrika.write \"BinaryStream.SaveToFile"

Detection condition:
all of them

Full rule:
rule FSO_s_ajan {
	meta:
		description = "Webshells Auto-generated - file ajan.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "22194f8c44524f80254e1b5aec67b03e"
		id = "03bf98b9-c8c5-5b9f-b0cd-700c5ed58eac"
	strings:
		$s4 = "entrika.write \"BinaryStream.SaveToFile"
	condition:
		all of them
}
YARA Detection Rule: c99shell
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file c99shell.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "<br />Input&nbsp;URL:&nbsp;&lt;input&nbsp;name=\\\"uploadurl\\\"&nbsp;type=\\\"text\\\"&"

Detection condition:
all of them

Full rule:
rule c99shell {
	meta:
		description = "Webshells Auto-generated - file c99shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "90b86a9c63e2cd346fe07cea23fbfc56"
		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
	strings:
		$s0 = "<br />Input&nbsp;URL:&nbsp;&lt;input&nbsp;name=\\\"uploadurl\\\"&nbsp;type=\\\"text\\\"&"
	condition:
		all of them
}
YARA Detection Rule: phpspy_2005_full
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file phpspy_2005_full.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s7 = "echo \"  <td align=\\\"center\\\" nowrap valign=\\\"top\\\"><a href=\\\"?downfile=\".urlenco"

Detection condition:
all of them

Full rule:
rule phpspy_2005_full {
	meta:
		description = "Webshells Auto-generated - file phpspy_2005_full.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "d1c69bb[PII_REDACTED]0e6c903bac16b2"
		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"
	strings:
		$s7 = "echo \"  <td align=\\\"center\\\" nowrap valign=\\\"top\\\"><a href=\\\"?downfile=\".urlenco"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_zehir4_2
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file zehir4.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s4 = "\"Program Files\\Serv-u\\Serv"

Detection condition:
all of them

Full rule:
rule FSO_s_zehir4_2 {
	meta:
		description = "Webshells Auto-generated - file zehir4.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "5b496a61363d304532bcf52ee21f5d55"
		id = "7de89d22-0230-508a-ac50-f61730ad9f4e"
	strings:
		$s4 = "\"Program Files\\Serv-u\\Serv"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_indexer_2
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file indexer.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s5 = "<td>Nerden :<td><input type=\"text\" name=\"nerden\" size=25 value=index.html></td>"

Detection condition:
all of them

Full rule:
rule FSO_s_indexer_2 {
	meta:
		description = "Webshells Auto-generated - file indexer.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "135fc50f85228691b401848caef3be9e"
		id = "8ef79a60-fa8c-51ee-bd87-f5467a66099b"
	strings:
		$s5 = "<td>Nerden :<td><input type=\"text\" name=\"nerden\" size=25 value=index.html></td>"
	condition:
		all of them
}
YARA Detection Rule: HYTop_DevPack_2005
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file 2005.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s7 = "theHref=encodeForUrl(mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\")"
		$s8 = "scrollbar-darkshadow-color:#9C9CD3;"
		$s9 = "scrollbar-face-color:#E4E4F3;"

Detection condition:
all of them

Full rule:
rule HYTop_DevPack_2005 {
	meta:
		description = "Webshells Auto-generated - file 2005.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "63d9fd24fa4d22a41fc5522fc7050f9f"
		id = "963effd9-f31d-5238-9419-b5dd11822e56"
	strings:
		$s7 = "theHref=encodeForUrl(mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\")"
		$s8 = "scrollbar-darkshadow-color:#9C9CD3;"
		$s9 = "scrollbar-face-color:#E4E4F3;"
	condition:
		all of them
}
YARA Detection Rule: _root_040_zip_Folder_deploy
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file deploy.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s5 = "halon synscan 127.0.0.1 1-65536"
		$s8 = "Obviously you replace the ip address with that of the target."

Detection condition:
all of them

Full rule:
rule _root_040_zip_Folder_deploy {
	meta:
		description = "Webshells Auto-generated - file deploy.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "2c9f9c58999256c73a5ebdb10a9be269"
		id = "7e592ab2-8a53-59d5-a45d[PII_REDACTED]79"
	strings:
		$s5 = "halon synscan 127.0.0.1 1-65536"
		$s8 = "Obviously you replace the ip address with that of the target."

	condition:
		all of them
}
YARA Detection Rule: by063cli
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file by063cli.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s2 = "#popmsghello,are you all right?"
		$s4 = "connect failed,check your network and remote ip."

Detection condition:
all of them

Full rule:
rule by063cli {
	meta:
		description = "Webshells Auto-generated - file by063cli.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "49ce26eb97fd13b6d92a5e5d169db859"
		id = "9b4a4842-e084-53e8-90fb-603ba034b7df"
	strings:
		$s2 = "#popmsghello,are you all right?"
		$s4 = "connect failed,check your network and remote ip."
	condition:
		all of them
}
YARA Detection Rule: icyfox007v1_10_rar_Folder_asp
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file asp.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "<SCRIPT RUNAT=SERVER LANGUAGE=JAVASCRIPT>eval(Request.form('#')+'')</SCRIPT>"

Detection condition:
all of them

Full rule:
rule icyfox007v1_10_rar_Folder_asp {
	meta:
		description = "Webshells Auto-generated - file asp.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "2c412400b146b7b98d6e7755f7159bb9"
		id = "52150b6a-2f60-5e6b-86d1-61bc0aeb4fa8"
	strings:
		$s0 = "<SCRIPT RUNAT=SERVER LANGUAGE=JAVASCRIPT>eval(Request.form('#')+'')</SCRIPT>"
	condition:
		all of them
}
YARA Detection Rule: byshell063_ntboot_2
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file ntboot.dll
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s6 = "OK,job was done,cuz we have localsystem & SE_DEBUG_NAME:)"

Detection condition:
all of them

Full rule:
rule byshell063_ntboot_2 {
	meta:
		description = "Webshells Auto-generated - file ntboot.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "cb9eb5a6ff327f4d6c46aacbbe9dda9d"
		id = "9bcb401d-619b-54b8-be51-f0e3b6eb096c"
	strings:
		$s6 = "OK,job was done,cuz we have localsystem & SE_DEBUG_NAME:)"
	condition:
		all of them
}
YARA Detection Rule: u_uay
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file uay.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "exec \"c:\\WINDOWS\\System32\\freecell.exe"
		$s9 = "SYSTEM\\CurrentControlSet\\Services\\uay.sys\\Security"

Detection condition:
1 of them

Full rule:
rule u_uay {
	meta:
		description = "Webshells Auto-generated - file uay.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "abbc7b31a24475e4c5d82fc4c2b8c7c4"
		id = "6a670e19-6e53-5b13-aabf-fe74d48b9113"
	strings:
		$s1 = "exec \"c:\\WINDOWS\\System32\\freecell.exe"
		$s9 = "SYSTEM\\CurrentControlSet\\Services\\uay.sys\\Security"
	condition:
		1 of them
}
YARA Detection Rule: bin_wuaus
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file wuaus.dll
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "9(90989@9V9^9f9n9v9"
		$s2 = ":(:,:0:4:8:C:H:N:T:Y:_:e:o:y:"
		$s3 = ";(=@=G=O=T=X=\\="
		$s4 = "TCP Send Error!!"
		$s5 = "1\"1;1X1^1e1m1w1~1"
		$s8 = "=$=)=/=<=Y=_=j=p=z="

Detection condition:
all of them

Full rule:
rule bin_wuaus {
	meta:
		description = "Webshells Auto-generated - file wuaus.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "46a365992bec7377b48a2263c49e4e7d"
		id = "50b5323b-d8d1-5350-bf93-8dde3d11fd87"
	strings:
		$s1 = "9(90989@9V9^9f9n9v9"
		$s2 = ":(:,:0:4:8:C:H:N:T:Y:_:e:o:y:"
		$s3 = ";(=@=G=O=T=X=\\="
		$s4 = "TCP Send Error!!"
		$s5 = "1\"1;1X1^1e1m1w1~1"
		$s8 = "=$=)=/=<=Y=_=j=p=z="
	condition:
		all of them
}
YARA Detection Rule: pwreveal
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file pwreveal.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "*<Blank - no es"
		$s3 = "JDiamondCS "
		$s8 = "sword set> [Leith=0 bytes]"
		$s9 = "ION\\System\\Floating-"

Detection condition:
all of them

Full rule:
rule pwreveal {
	meta:
		description = "Webshells Auto-generated - file pwreveal.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "b4e8447826a45b76ca45ba151a97ad50"
		id = "3d79dd13-9012-56e2-b42a-e6b3e204c601"
	strings:
		$s0 = "*<Blank - no es"
		$s3 = "JDiamondCS "
		$s8 = "sword set> [Leith=0 bytes]"
		$s9 = "ION\\System\\Floating-"
	condition:
		all of them
}
YARA Detection Rule: shelltools_g0t_root_xwhois
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file xwhois.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "rting! "
		$s2 = "aTypCog("
		$s5 = "Diamond"
		$s6 = "r)r=rQreryr"

Detection condition:
all of them

Full rule:
rule shelltools_g0t_root_xwhois {
	meta:
		description = "Webshells Auto-generated - file xwhois.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "0bc98bd576c80d921a3460f8be8816b4"
		id = "8f3b3bb2-5884-584a-8220-b6edbfebc8a3"
	strings:
		$s1 = "rting! "
		$s2 = "aTypCog("
		$s5 = "Diamond"
		$s6 = "r)r=rQreryr"
	condition:
		all of them
}
YARA Detection Rule: vanquish_2
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file vanquish.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s2 = "Vanquish - DLL injection failed:"

Detection condition:
all of them

Full rule:
rule vanquish_2 {
	meta:
		description = "Webshells Auto-generated - file vanquish.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "2dcb9055785a2ee01567f52b5a62b071"
		id = "6736cad6-cba1-5b6f-ae05-e2b980280479"
	strings:
		$s2 = "Vanquish - DLL injection failed:"
	condition:
		all of them
}
YARA Detection Rule: down_rar_Folder_down
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file down.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "response.write \"<font color=blue size=2>NetBios Name: \\\\\"  & Snet.ComputerName &"

Detection condition:
all of them

Full rule:
rule down_rar_Folder_down {
	meta:
		description = "Webshells Auto-generated - file down.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "db47d7a12b3584a2e[PII_REDACTED]86e71"
		id = "4e0a0e03-4f01-5b58-807c-0934cdda77ab"
	strings:
		$s0 = "response.write \"<font color=blue size=2>NetBios Name: \\\\\"  & Snet.ComputerName &"
	condition:
		all of them
}
YARA Detection Rule: cmdShell
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file cmdShell.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "if cmdPath=\"wscriptShell\" then"

Detection condition:
all of them

Full rule:
rule cmdShell {
	meta:
		description = "Webshells Auto-generated - file cmdShell.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "8a9fef43209b5d2d4b81dfbb45182036"
		id = "be256fc4-8dc5-58e4-9ca2-5a1df936b8dd"
	strings:
		$s1 = "if cmdPath=\"wscriptShell\" then"
	condition:
		all of them
}