deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: apt_nix_elf_Derusbi_Linux_Strings
Repository: Yara-Rules/rules
Author: @seifreed

Pattern signatures:
$a1 = "loadso" wide ascii fullword
        $a2 = "\nuname -a\n\n" wide ascii
        $a3 = "/dev/shm/.x11.id" wide ascii
        $a4 = "LxMain64" wide ascii nocase
        $a5 = "# \\u@\\h:\\w \\$ " wide ascii
        $b1 = "[PII_REDACTED]abcdefghijklmnopqrstuvwxyz" wide
        $b2 = "[PII_REDACTED]ABCDEFGHIJKLMNOPQRSTUVWXYZ" wide
        $b3 = "ret %d" wide fullword
        $b4 = "uname -a\n\n" wide ascii
        $b5 = "/proc/%u/cmdline" wide ascii
        $b6 = "/proc/self/exe" wide ascii
        $b7 = "cp -a %s %s" wide ascii
        $c1 = "/dev/pts/4" wide ascii fullword
        $c2 = "/tmp/1408.log" wide ascii fullword

Detection condition:
uint32(0) == 0x464C457F and ((1 of ($a*) and 4 of ($b*)) or (1 of ($a*) and 1 of ($c*)) or 2 of ($a*) or all of ($b*))

Full rule:
rule apt_nix_elf_Derusbi_Linux_Strings
{

    meta:
        Author = "@seifreed"

    strings:
        $a1 = "loadso" wide ascii fullword
        $a2 = "\nuname -a\n\n" wide ascii
        $a3 = "/dev/shm/.x11.id" wide ascii
        $a4 = "LxMain64" wide ascii nocase
        $a5 = "# \\u@\\h:\\w \\$ " wide ascii
        $b1 = "[PII_REDACTED]abcdefghijklmnopqrstuvwxyz" wide
        $b2 = "[PII_REDACTED]ABCDEFGHIJKLMNOPQRSTUVWXYZ" wide
        $b3 = "ret %d" wide fullword
        $b4 = "uname -a\n\n" wide ascii
        $b5 = "/proc/%u/cmdline" wide ascii
        $b6 = "/proc/self/exe" wide ascii
        $b7 = "cp -a %s %s" wide ascii
        $c1 = "/dev/pts/4" wide ascii fullword
        $c2 = "/tmp/1408.log" wide ascii fullword

    condition:
        uint32(0) == 0x464C457F and ((1 of ($a*) and 4 of ($b*)) or (1 of ($a*) and 1 of ($c*)) or 2 of ($a*) or all of ($b*))
}
YARA Detection Rule: apt_win_exe_trojan_derusbi
Repository: Yara-Rules/rules
Author: @seifreed

Pattern signatures:
$sa_1 = "USB" wide ascii
        $sa_2 = "RAM" wide ascii
        $sa_3 = "SHARE" wide ascii
        $sa_4 = "HOST: %s:%d"
        $sa_5 = "POST"
        $sa_6 = "User-Agent: Mozilla"
        $sa_7 = "Proxy-Connection: Keep-Alive"
        $sa_8 = "Connection: Keep-Alive"
        $sa_9 = "Server: Apache"
        $sa_10 = "HTTP/1.1"
        $sa_11 = "ImagePath"
        $sa_12 = "ZwUnloadDriver"
        $sa_13 = "ZwLoadDriver"
        $sa_14 = "ServiceMain"
        $sa_15 = "regsvr32.exe"
        $sa_16 = "/s /u" wide ascii
        $sa_17 = "rand"
        $sa_18 = "_time64"
        $sa_19 = "DllRegisterServer"
        $sa_20 = "DllUnregisterServer"
        $sa_21 = { 8b [5] 8b ?? d3 ?? 83 ?? 08 30 [5] 40 3b [5] 72 } // Decode Driver
        $sb_1 = "PCC_CMD_PACKET"
        $sb_2 = "PCC_CMD"
        $sb_3 = "PCC_BASEMOD"
        $sb_4 = "PCC_PROXY"
        $sb_5 = "PCC_SYS"
        $sb_6 = "PCC_PROCESS"
        $sb_7 = "PCC_FILE"
        $sb_8 = "PCC_SOCK"
        $sc_1 = "bcdedit -set tes

Detection condition:
(uint16(0) == 0x5A4D) and ( (all of ($sa_*)) or ((13 of ($sa_*)) and ( (5 of ($sb_*)) or (3 of ($sc_*)) or (all of ($sd_*)) or ( (1 of ($sc_*)) and (all of ($se_*)) ) ) ) )

Full rule:
rule apt_win_exe_trojan_derusbi
{

   meta:
        Author = "@seifreed"

   strings:
        $sa_1 = "USB" wide ascii
        $sa_2 = "RAM" wide ascii
        $sa_3 = "SHARE" wide ascii
        $sa_4 = "HOST: %s:%d"
        $sa_5 = "POST"
        $sa_6 = "User-Agent: Mozilla"
        $sa_7 = "Proxy-Connection: Keep-Alive"
        $sa_8 = "Connection: Keep-Alive"
        $sa_9 = "Server: Apache"
        $sa_10 = "HTTP/1.1"
        $sa_11 = "ImagePath"
        $sa_12 = "ZwUnloadDriver"
        $sa_13 = "ZwLoadDriver"
        $sa_14 = "ServiceMain"
        $sa_15 = "regsvr32.exe"
        $sa_16 = "/s /u" wide ascii
        $sa_17 = "rand"
        $sa_18 = "_time64"
        $sa_19 = "DllRegisterServer"
        $sa_20 = "DllUnregisterServer"
        $sa_21 = { 8b [5] 8b ?? d3 ?? 83 ?? 08 30 [5] 40 3b [5] 72 } // Decode Driver
        $sb_1 = "PCC_CMD_PACKET"
        $sb_2 = "PCC_CMD"
        $sb_3 = "PCC_BASEMOD"
        $sb_4 = "PCC_PROXY"
        $sb_5 = "PCC_SYS"
        $sb_6 = "PCC_PROCESS"
        $sb_7 = "PCC_FILE"
        $sb_8 = "PCC_SOCK"
        $sc_1 = "bcdedit -set testsigning" wide ascii
        $sc_2 = "update.microsoft.com" wide ascii
        $sc_3 = "_crt_debugger_hook" wide ascii
        $sc_4 = "ue8G5" wide ascii
        $sd_1 = "NET" wide ascii
        $sd_2 = "\\\\.\\pipe\\%s" wide ascii
        $sd_3 = ".dat" wide ascii
        $sd_4 = "CONNECT %s:%d" wide ascii
        $sd_5 = "\\Device\\" wide ascii
        $se_1 = "-%s-%04d" wide ascii
        $se_2 = "-%04d" wide ascii
        $se_3 = "FAL" wide ascii
        $se_4 = "OK" wide ascii
        $se_5 = "2.03" wide ascii
        $se_6 = "XXXXXXXXXXXXXXX" wide ascii

   condition:
      (uint16(0) == 0x5A4D) and ( (all of ($sa_*)) or ((13 of ($sa_*)) and ( (5 of ($sb_*)) or (3 of ($sc_*)) or (all of ($sd_*)) or ( (1 of ($sc_*)) and (all of ($se_*)) ) ) ) )
}
YARA Detection Rule: Trojan_Derusbi
Repository: Yara-Rules/rules
Author: RSA_IR

Pattern signatures:
$b1 = {8b 15 ?? ?? ?? ?? 8b ce d3 ea 83 c6 ?? 30 90 ?? ?? ?? ?? 40 3b 05 ?? ?? ?? ?? 72 ??}
        $b2 = {F3 5D 88 2E ?? ?? 00 00 BE 07 18 2E F0 5D 88 2E F7 5D 88 2E 0C A2 88 2E 4B 5D 88 2E F3 5D 88 2E}
        $b3 = {4E E6 40 BB}
        $b4 = {B1 19 BF 44}
        $b5 = {6A F5 44 3D ?? ?? 00 00 27 AF D4 3D 69 F5 44 3D 6E F5 44 3D 95 0A 44 3D D2 F5 44 3D 6A F5 44 3D}
        $b6 = {F3 5D 88 2E ?? ?? 00 00 BE 07 18 2E F0 5D 88 2E}
        $b7 = {D6 D5 A4 A3 ?? ?? 00 00 9B 8F 34 A3 D5 D5 A4 A3 D2 D5 A4 A3 29 2A A4 A3}
        $b8 = {C3 76 33 9F ?? ?? 00 00 8E 2C A3 9F C0 76 33 9F C7 76 33 9F 3C 89 33 9F}

Detection condition:
2 of ($b1, $b2, $b3, $b4) and 1 of ($b5, $b6, $b7, $b8)

Full rule:
rule Trojan_Derusbi
{

    meta:
        Author = "RSA_IR"
        Date     = "4Sept13"
        File     = "derusbi_variants v 1.3"
        MD5      = " c0d4c5b669cc5b51862db37e972d31ec "

    strings:
        $b1 = {8b 15 ?? ?? ?? ?? 8b ce d3 ea 83 c6 ?? 30 90 ?? ?? ?? ?? 40 3b 05 ?? ?? ?? ?? 72 ??}
        $b2 = {F3 5D 88 2E ?? ?? 00 00 BE 07 18 2E F0 5D 88 2E F7 5D 88 2E 0C A2 88 2E 4B 5D 88 2E F3 5D 88 2E}
        $b3 = {4E E6 40 BB}
        $b4 = {B1 19 BF 44}
        $b5 = {6A F5 44 3D ?? ?? 00 00 27 AF D4 3D 69 F5 44 3D 6E F5 44 3D 95 0A 44 3D D2 F5 44 3D 6A F5 44 3D}
        $b6 = {F3 5D 88 2E ?? ?? 00 00 BE 07 18 2E F0 5D 88 2E}
        $b7 = {D6 D5 A4 A3 ?? ?? 00 00 9B 8F 34 A3 D5 D5 A4 A3 D2 D5 A4 A3 29 2A A4 A3}
        $b8 = {C3 76 33 9F ?? ?? 00 00 8E 2C A3 9F C0 76 33 9F C7 76 33 9F 3C 89 33 9F}

    condition:
        2 of ($b1, $b2, $b3, $b4) and 1 of ($b5, $b6, $b7, $b8)
}
YARA Detection Rule: APT_Derusbi_DeepPanda
Repository: Yara-Rules/rules
Author: ThreatConnect Intelligence Research Team
Reference: http://www.crowdstrike.com/sites/default/files/AdversaryIntelligenceReport_DeepPanda_0.pdf

Pattern signatures:
$D = "Dom4!nUserP4ss" wide ascii

Detection condition:
$D

Full rule:
rule APT_Derusbi_DeepPanda
{

meta:
    author = "ThreatConnect Intelligence Research Team"
    reference = "http://www.crowdstrike.com/sites/default/files/AdversaryIntelligenceReport_DeepPanda_0.pdf"

strings:
    $D = "Dom4!nUserP4ss" wide ascii

condition:
    $D
}
YARA Detection Rule: APT_Derusbi_Gen
Repository: Yara-Rules/rules
Author: ThreatConnect Intelligence Research Team

Pattern signatures:
$2 = "273ce6-b29f-90d618c0" wide ascii
    $A = "Ace123dx" fullword wide ascii
    $A1 = "Ace123dxl!" fullword wide ascii
    $A2 = "Ace123dx!@#x" fullword wide ascii
    $C = "/Catelog/login1.asp" wide ascii
    $DF = "~DFTMP$$$$$.1" wide ascii
    $G = "GET /Query.asp?loginid=" wide ascii
    $L = "LoadConfigFromReg failded" wide ascii
    $L1 = "LoadConfigFromBuildin success" wide ascii
    $ph = "/photoe/photo.asp HTTP" wide ascii
    $PO = "POST /photos/photo.asp" wide ascii
    $PC = "PCC_IDENT" wide ascii

Detection condition:
any of them

Full rule:
rule APT_Derusbi_Gen
{

meta:
    author = "ThreatConnect Intelligence Research Team"

strings:
    $2 = "273ce6-b29f-90d618c0" wide ascii
    $A = "Ace123dx" fullword wide ascii
    $A1 = "Ace123dxl!" fullword wide ascii
    $A2 = "Ace123dx!@#x" fullword wide ascii
    $C = "/Catelog/login1.asp" wide ascii
    $DF = "~DFTMP$$$$$.1" wide ascii
    $G = "GET /Query.asp?loginid=" wide ascii
    $L = "LoadConfigFromReg failded" wide ascii
    $L1 = "LoadConfigFromBuildin success" wide ascii
    $ph = "/photoe/photo.asp HTTP" wide ascii
    $PO = "POST /photos/photo.asp" wide ascii
    $PC = "PCC_IDENT" wide ascii

condition:
    any of them
}
YARA Detection Rule: derusbi_kernel
Repository: Yara-Rules/rules
Detects: Derusbi Driver version
Author: Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud

Pattern signatures:
$token1 = "$$$--Hello"
        $token2 = "Wrod--$$$"
        $cfg = "XXXXXXXXXXXXXXX"
        $class = ".?AVPCC_BASEMOD@@"
        $MZ = "MZ"

Detection condition:
$MZ at 0 and $token1 and $token2 and $cfg and $class

Full rule:
rule derusbi_kernel
{

    meta:
        description = "Derusbi Driver version"
        date = "2015-12-09"
        author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"

    strings:
        $token1 = "$$$--Hello"
        $token2 = "Wrod--$$$"
        $cfg = "XXXXXXXXXXXXXXX"
        $class = ".?AVPCC_BASEMOD@@"
        $MZ = "MZ"

    condition:
        $MZ at 0 and $token1 and $token2 and $cfg and $class
}
YARA Detection Rule: derusbi_linux
Repository: Yara-Rules/rules
Detects: Derusbi Server Linux version
Author: Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud

Pattern signatures:
$PS1 = "PS1=RK# \\u@\\h:\\w \\$"
        $cmd = "unset LS_OPTIONS;uname -a"
        $pname = "[diskio]"
        $rkfile = "/tmp/.secure"
        $ELF = "\x7fELF"

Detection condition:
$ELF at 0 and $PS1 and $cmd and $pname and $rkfile

Full rule:
rule derusbi_linux
{

    meta:
        description = "Derusbi Server Linux version"
        date = "2015-12-09"
        author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"

    strings:
        $PS1 = "PS1=RK# \\u@\\h:\\w \\$"
        $cmd = "unset LS_OPTIONS;uname -a"
        $pname = "[diskio]"
        $rkfile = "/tmp/.secure"
        $ELF = "\x7fELF"

    condition:
        $ELF at 0 and $PS1 and $cmd and $pname and $rkfile
}
YARA Detection Rule: Derusbi_Kernel_Driver_WD_UDFS
Repository: Yara-Rules/rules
Detects: Detects Derusbi Kernel Driver
Author: Florian Roth
Reference: http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family

Pattern signatures:
$x1 = "\\\\.\\pipe\\usbpcex%d" fullword wide
        $x2 = "\\\\.\\pipe\\usbpcg%d" fullword wide
        $x3 = "\\??\\pipe\\usbpcex%d" fullword wide
        $x4 = "\\??\\pipe\\usbpcg%d" fullword wide
        $x5 = "$$$--Hello" fullword ascii
        $x6 = "Wrod--$$$" fullword ascii
        $s1 = "\\Registry\\User\\%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword wide
        $s2 = "Update.dll" fullword ascii
        $s3 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\WMI" fullword wide
        $s4 = "\\Driver\\nsiproxy" fullword wide
        $s5 = "HOST: %s" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 800KB and (2 of ($x*) or all of ($s*))

Full rule:
rule Derusbi_Kernel_Driver_WD_UDFS
{

    meta:
        description = "Detects Derusbi Kernel Driver"
        author = "Florian Roth"
        reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
        date = "2015-12-15"
        score = 80
        hash1 = "1b449121300b0188ff9f6a8c399fb818d0cf53fd36cf012e6908a2665a27f016"
        hash2 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
        hash3 = "6cdb65dbfb2c236b6d149fd9836cb484d0608ea082cf5bd88edde31ad11a0d58"
        hash4 = "e27fb16dce7fff714f4b05f2cef53e1919a34d7ec0e595f2eaa155861a213e59"

    strings:
        $x1 = "\\\\.\\pipe\\usbpcex%d" fullword wide
        $x2 = "\\\\.\\pipe\\usbpcg%d" fullword wide
        $x3 = "\\??\\pipe\\usbpcex%d" fullword wide
        $x4 = "\\??\\pipe\\usbpcg%d" fullword wide
        $x5 = "$$$--Hello" fullword ascii
        $x6 = "Wrod--$$$" fullword ascii
        $s1 = "\\Registry\\User\\%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword wide
        $s2 = "Update.dll" fullword ascii
        $s3 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\WMI" fullword wide
        $s4 = "\\Driver\\nsiproxy" fullword wide
        $s5 = "HOST: %s" fullword ascii

condition:
        uint16(0) == 0x5a4d and filesize < 800KB and (2 of ($x*) or all of ($s*))
}
YARA Detection Rule: Derusbi_Code_Signing_Cert
Repository: Yara-Rules/rules
Detects: Detects an executable signed with a certificate also used for Derusbi Trojan - suspicious
Author: Florian Roth
Reference: http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family

Pattern signatures:
$s1 = "Fuqing Dawu Technology Co.,Ltd.0" fullword ascii
      $s2 = "XL Games Co.,Ltd.0" fullword ascii
      $s3 = "Wemade Entertainment co.,Ltd0" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 800KB and 1 of them

Full rule:
rule Derusbi_Code_Signing_Cert
{

    meta:
        description = "Detects an executable signed with a certificate also used for Derusbi Trojan - suspicious"
        author = "Florian Roth"
        reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
        date = "2015-12-15"
        score = 40

   strings:
      $s1 = "Fuqing Dawu Technology Co.,Ltd.0" fullword ascii
      $s2 = "XL Games Co.,Ltd.0" fullword ascii
      $s3 = "Wemade Entertainment co.,Ltd0" fullword ascii

   condition:
      uint16(0) == 0x5a4d and filesize < 800KB and 1 of them
}
YARA Detection Rule: XOR_4byte_Key
Repository: Yara-Rules/rules
Detects: Detects an executable encrypted with a 4 byte XOR (also used for Derusbi Trojan)
Author: Florian Roth
Reference: http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family

Pattern signatures:
/* Op Code */
      $s1 = { 85 C9 74 0A 31 06 01 1E 83 C6 04 49 EB F2 }
      /*
      test    ecx, ecx
      jz      short loc_590170
      xor     [esi], eax
      add     [esi], ebx
      add     esi, 4
      dec     ecx
      jmp     short loc_590162
      */

Detection condition:
uint16(0) == 0x5a4d and filesize < 900KB and all of them

Full rule:
rule XOR_4byte_Key
{

    meta:
        description = "Detects an executable encrypted with a 4 byte XOR (also used for Derusbi Trojan)"
        author = "Florian Roth"
        reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
        date = "2015-12-15"
        score = 60

   strings:
      /* Op Code */
      $s1 = { 85 C9 74 0A 31 06 01 1E 83 C6 04 49 EB F2 }
      /*
      test    ecx, ecx
      jz      short loc_590170
      xor     [esi], eax
      add     [esi], ebx
      add     esi, 4
      dec     ecx
      jmp     short loc_590162
      */

   condition:
      uint16(0) == 0x5a4d and filesize < 900KB and all of them
}
YARA Detection Rule: apt_win32_dll_bergard_pgv_pvid_variant
Repository: Yara-Rules/rules
Reference: http://www.threatgeek.com/2016/05/turbo-twist-two-64-bit-derusbi-strains-converge.html

Pattern signatures:
$ = "Accept:"
        $ = "User-Agent: %s"
        $ = "Host: %s:%d"
        $ = "Cache-Control: no-cache"
        $ = "Connection: Keep-Alive"
        $ = "Cookie: pgv_pvid="
        $ = "Content-Type: application/x-octet-stream"
        $ = "User-Agent: %s"
        $ = "Host: %s:%d"
        $ = "Pragma: no-cache"
        $ = "Connection: Keep-Alive"
        $ = "HTTP/1.0"

Detection condition:
(uint16(0) == 0x5A4D) and (all of them)

Full rule:
rule apt_win32_dll_bergard_pgv_pvid_variant
{

    meta:
        copyright = "Fidelis Cybersecurity"
        reference = "http://www.threatgeek.com/2016/05/turbo-twist-two-64-bit-derusbi-strains-converge.html"

    strings:
        $ = "Accept:"
        $ = "User-Agent: %s"
        $ = "Host: %s:%d"
        $ = "Cache-Control: no-cache"
        $ = "Connection: Keep-Alive"
        $ = "Cookie: pgv_pvid="
        $ = "Content-Type: application/x-octet-stream"
        $ = "User-Agent: %s"
        $ = "Host: %s:%d"
        $ = "Pragma: no-cache"
        $ = "Connection: Keep-Alive"
        $ = "HTTP/1.0"

    condition:
        (uint16(0) == 0x5A4D) and (all of them)
}
YARA Detection Rule: Emotets
Repository: Yara-Rules/rules
Detects: Emotets
Author: pekeinfo

Pattern signatures:
$mz = { 4d 5a }
  $cmovnz={ 0f 45 fb 0f 45 de }
  $mov_esp_0={ C7 04 24 00 00 00 00 89 44 24 0? }
  $_eax={ 89 E? 8D ?? 24 ?? 89 ?? FF D0 83 EC 04 }

Detection condition:
($mz at 0 and $_eax in( 0x2854..0x4000)) and ($cmovnz or $mov_esp_0)

Full rule:
rule Emotets{
meta:
  author = "pekeinfo"
  date = "2017-10-18"
  description = "Emotets"
strings:
  $mz = { 4d 5a }
  $cmovnz={ 0f 45 fb 0f 45 de }
  $mov_esp_0={ C7 04 24 00 00 00 00 89 44 24 0? }
  $_eax={ 89 E? 8D ?? 24 ?? 89 ?? FF D0 83 EC 04 }
condition:
  ($mz at 0 and $_eax in( 0x2854..0x4000)) and ($cmovnz or $mov_esp_0)
}
YARA Detection Rule: HKTL_NET_NAME_FakeFileMaker
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/DamonMohammadbagher/FakeFileMaker

Pattern signatures:
$name = "FakeFileMaker" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_FakeFileMaker {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/DamonMohammadbagher/FakeFileMaker"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "FakeFileMaker" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_Aggressor
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/k8gege/Aggressor

Pattern signatures:
$name = "Aggressor" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_Aggressor {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/k8gege/Aggressor"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "Aggressor" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_pentestscripts
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/c4bbage/pentestscripts

Pattern signatures:
$name = "pentestscripts" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_pentestscripts {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/c4bbage/pentestscripts"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "pentestscripts" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_WMIPersistence
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/mdsecactivebreach/WMIPersistence

Pattern signatures:
$name = "WMIPersistence" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_WMIPersistence {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/mdsecactivebreach/WMIPersistence"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "WMIPersistence" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_ADCollector
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/dev-2null/ADCollector

Pattern signatures:
$name = "ADCollector" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_ADCollector {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/dev-2null/ADCollector"
        hash = "5391239f479c26e699b6f3a1d6a0a8aa1a0cf9a8"
        hash = "9dd0f322dd57b906da1e543c44e764954704abae"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "ADCollector" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_MaliciousClickOnceGenerator
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/Mr-Un1k0d3r/MaliciousClickOnceGenerator

Pattern signatures:
$name = "MaliciousClickOnceGenerator" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_MaliciousClickOnceGenerator {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/Mr-Un1k0d3r/MaliciousClickOnceGenerator"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "MaliciousClickOnceGenerator" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_directInjectorPOC
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/badBounty/directInjectorPOC

Pattern signatures:
$name = "directInjectorPOC" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_directInjectorPOC {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/badBounty/directInjectorPOC"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "directInjectorPOC" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_AsStrongAsFuck
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/Charterino/AsStrongAsFuck

Pattern signatures:
$name = "AsStrongAsFuck" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_AsStrongAsFuck {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/Charterino/AsStrongAsFuck"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "AsStrongAsFuck" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}