deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: IronTiger_PlugX_Server
Repository: Neo23x0/signature-base
Detects: Iron Tiger Malware - PlugX Server
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "\\UnitFrmManagerKeyLog.pas" wide ascii
		$str2 = "\\UnitFrmManagerRegister.pas" wide ascii
		$str3 = "Input Name..." wide ascii
		$str4 = "New Value#" wide ascii
		$str5 = "TThreadRControl.Execute SEH!!!" wide ascii
		$str6 = "\\UnitFrmRControl.pas" wide ascii
		$str7 = "OnSocket(event is error)!" wide ascii
		$str8 = "Make 3F Version Ok!!!" wide ascii
		$str9 = "PELEASE DO NOT CHANGE THE DOCAMENT" wide ascii
		$str10 = "Press [Ok] Continue Run, Press [Cancel] Exit" wide ascii

Detection condition:
uint16(0) == 0x5a4d and (2 of ($str*))

Full rule:
rule IronTiger_PlugX_Server
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger Malware - PlugX Server"
		reference = "http://goo.gl/T5fSJC"
		id = "38011a23-3ed7-5f58-a[PII_REDACTED]b27f3"
	strings:
		$str1 = "\\UnitFrmManagerKeyLog.pas" wide ascii
		$str2 = "\\UnitFrmManagerRegister.pas" wide ascii
		$str3 = "Input Name..." wide ascii
		$str4 = "New Value#" wide ascii
		$str5 = "TThreadRControl.Execute SEH!!!" wide ascii
		$str6 = "\\UnitFrmRControl.pas" wide ascii
		$str7 = "OnSocket(event is error)!" wide ascii
		$str8 = "Make 3F Version Ok!!!" wide ascii
		$str9 = "PELEASE DO NOT CHANGE THE DOCAMENT" wide ascii
		$str10 = "Press [Ok] Continue Run, Press [Cancel] Exit" wide ascii
	condition:
		uint16(0) == 0x5a4d and (2 of ($str*))
}
YARA Detection Rule: IronTiger_ReadPWD86
Repository: Neo23x0/signature-base
Detects: Iron Tiger Malware - ReadPWD86
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "Fail To Load LSASRV" wide ascii
		$str2 = "Fail To Search LSASS Data" wide ascii
		$str3 = "User Principal" wide ascii

Detection condition:
uint16(0) == 0x5a4d and (all of ($str*))

Full rule:
rule IronTiger_ReadPWD86
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger Malware - ReadPWD86"
		reference = "http://goo.gl/T5fSJC"
		id = "5db832be-4b8e-536f-8db7-a215a90284e2"
	strings:
		$str1 = "Fail To Load LSASRV" wide ascii
		$str2 = "Fail To Search LSASS Data" wide ascii
		$str3 = "User Principal" wide ascii
	condition:
		uint16(0) == 0x5a4d and (all of ($str*))
}
YARA Detection Rule: IronTiger_Ring_Gh0stvariant
Repository: Neo23x0/signature-base
Detects: Iron Tiger Malware - Ring Gh0stvariant
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "RING RAT Exception" wide ascii
		$str2 = "(can not update server recently)!" wide ascii
		$str4 = "CreaetProcess Error" wide ascii
		$bla1 = "Sucess!" wide ascii
		$bla2 = "user canceled!" wide ascii

Detection condition:
uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))

Full rule:
rule IronTiger_Ring_Gh0stvariant
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger Malware - Ring Gh0stvariant"
		reference = "http://goo.gl/T5fSJC"
		id = "6858550a-4000-581c-b270-370db8ed1c57"
	strings:
		$str1 = "RING RAT Exception" wide ascii
		$str2 = "(can not update server recently)!" wide ascii
		$str4 = "CreaetProcess Error" wide ascii
		$bla1 = "Sucess!" wide ascii
		$bla2 = "user canceled!" wide ascii
	condition:
		uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))
}
YARA Detection Rule: IronTiger_wmiexec
Repository: Neo23x0/signature-base
Detects: Iron Tiger Tool - wmi.vbs detection
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "Temp Result File , Change it to where you like" wide ascii
		$str2 = "wmiexec" wide ascii
		$str3 = "By. Twi1ight" wide ascii
		$str4 = "[both mode] ,delay TIME to read result" wide ascii
		$str5 = "such as nc.exe or Trojan" wide ascii
		$str6 = "+++shell mode+++" wide ascii
		$str7 = "win2008 fso has no privilege to delete file" wide ascii

Detection condition:
2 of ($str*)

Full rule:
rule IronTiger_wmiexec
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger Tool - wmi.vbs detection"
		reference = "http://goo.gl/T5fSJC"
		id = "a3060f50-3594-5da9-98e2-6fa0087451f5"
	strings:
		$str1 = "Temp Result File , Change it to where you like" wide ascii
		$str2 = "wmiexec" wide ascii
		$str3 = "By. Twi1ight" wide ascii
		$str4 = "[both mode] ,delay TIME to read result" wide ascii
		$str5 = "such as nc.exe or Trojan" wide ascii
		$str6 = "+++shell mode+++" wide ascii
		$str7 = "win2008 fso has no privilege to delete file" wide ascii
	condition:
		2 of ($str*)
}
YARA Detection Rule: APT_ME_BigBang_Mal_Jul18_1
Repository: Neo23x0/signature-base
Detects: Detects malware from Big Bang report
Author: Florian Roth (Nextron Systems)
Reference: https://research.checkpoint.com/apt-attack-middle-east-big-bang/

Pattern signatures:
$s1 = "%Y%m%d-%I-%M-%S" fullword ascii
      $s2 = "/api/serv/requests/%s/runfile/delete" fullword ascii
      $s3 = "\\part.txt" ascii
      $s4 = "\\ALL.txt" ascii
      $s5 = "\\sat.txt" ascii
      $s6 = "runfile.proccess_name" fullword ascii
      $s7 = "%s%s%p%s%zd%s%d%s%s%s%s%s" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 3000KB and 4 of them

Full rule:
rule APT_ME_BigBang_Mal_Jul18_1 {
   meta:
      description = "Detects malware from Big Bang report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://research.checkpoint.com/apt-attack-middle-east-big-bang/"
      date = "2018-07-09"
      hash1 = "ac6462e9e26362f711783b9874d46fefce198c4c3ca947a5d4df7842a6c51224"
      hash2 = "e1f52ea30d25289f7a4a5c9d15be97c8a4dfe10eb68ac9d031edcc7275c23dbc"
      id = "f30b2e11-f90a-5068-8eaa-25f11218ec6c"
   strings:
      $s1 = "%Y%m%d-%I-%M-%S" fullword ascii
      $s2 = "/api/serv/requests/%s/runfile/delete" fullword ascii
      $s3 = "\\part.txt" ascii
      $s4 = "\\ALL.txt" ascii
      $s5 = "\\sat.txt" ascii
      $s6 = "runfile.proccess_name" fullword ascii
      $s7 = "%s%s%p%s%zd%s%d%s%s%s%s%s" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 3000KB and 4 of them
}
YARA Detection Rule: Invoke_mimikittenz
Repository: Neo23x0/signature-base
Detects: Detects Mimikittenz - file Invoke-mimikittenz.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/putterpanda/mimikittenz

Pattern signatures:
$x1 = "[mimikittenz.MemProcInspector]" ascii

		$s1 = "PROCESS_ALL_ACCESS = PROCESS_TERMINATE | PROCESS_CREATE_THREAD | PROCESS_SET_SESSIONID | PROCESS_VM_OPERATION |" fullword ascii
		$s2 = "IntPtr processHandle = MInterop.OpenProcess(MInterop.PROCESS_WM_READ | MInterop.PROCESS_QUERY_INFORMATION, false, process.Id);" fullword ascii
		$s3 = "&email=.{1,48}&create=.{1,2}&password=.{1,22}&metadata1=" ascii
		$s4 = "[DllImport(\"kernel32.dll\", SetLastError = true)]" fullword ascii

Detection condition:
( uint16(0) == 0x7566 and filesize < 60KB and 2 of them ) or $x1

Full rule:
rule Invoke_mimikittenz {
	meta:
		description = "Detects Mimikittenz - file Invoke-mimikittenz.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/putterpanda/mimikittenz"
		date = "2016-07-19"
		score = 90
		hash1 = "14e2f70470396a18c27debb419a4f4063c2ad5b6976f429d47f55e31066a5e6a"
		id = "6dcf3d0a-302b-520c-97c6-fd843c8a25b9"
	strings:
		$x1 = "[mimikittenz.MemProcInspector]" ascii

		$s1 = "PROCESS_ALL_ACCESS = PROCESS_TERMINATE | PROCESS_CREATE_THREAD | PROCESS_SET_SESSIONID | PROCESS_VM_OPERATION |" fullword ascii
		$s2 = "IntPtr processHandle = MInterop.OpenProcess(MInterop.PROCESS_WM_READ | MInterop.PROCESS_QUERY_INFORMATION, false, process.Id);" fullword ascii
		$s3 = "&email=.{1,48}&create=.{1,2}&password=.{1,22}&metadata1=" ascii
		$s4 = "[DllImport(\"kernel32.dll\", SetLastError = true)]" fullword ascii
	condition:
		( uint16(0) == 0x7566 and filesize < 60KB and 2 of them ) or $x1
}
YARA Detection Rule: gen_exploit_CVE_2017_10271_WebLogic
Repository: Neo23x0/signature-base
Detects: Exploit for CVE-2017-10271 (Oracle WebLogic)
Author: John Lambert @JohnLaTwC
Reference: https://github.com/c0mmand3rOpSec/CVE-2017-10271, https://www.fireeye.com/blog/threat-research/2018/02/cve-2017-10271-used-to-deliver-cryptominers.html

Pattern signatures:
$s1 = "<soapenv:Header"
        $s2 = "java.beans.XMLDecoder"
        $s3 = "void" fullword
        $s4 = "index="
        $s5 = "/array>"
        $s6 = "\"start\""
        $s7 = "work:WorkContext" nocase

Detection condition:
filesize < 10KB
        and (uint32(0) == 0x616f733c or uint32(0) == 0x54534f50)  //'<soa' or 'POST'
        and all of ($s*)

Full rule:
rule gen_exploit_CVE_2017_10271_WebLogic : HIGHVOL
{
    meta: 
        description = "Exploit for CVE-2017-10271 (Oracle WebLogic)"
        author = "John Lambert @JohnLaTwC"
        date = "2018-03-21"
        hash1 = "376c2bc11d4c366ad4f6fecffc0bea8b195e680b4c52a48d85a8d3f9fab01c95"
        hash2 = "7d5819a2ea62376e24f0dd3cf5466d97bbbf4f5f730eb[PII_REDACTED]b363967ea"
        hash3 = "864e9d8904941fae90ddd10eb03d998f85707dc2faff80cba2e365a64e830e1d/subfile"
        hash4 = "2a69e46094d0fef2b3ffcab73086c16a10b517f58e0c1f743ece4f246889962b"
        reference = "https://github.com/c0mmand3rOpSec/CVE-2017-10271, https://www.fireeye.com/blog/threat-research/2018/02/cve-2017-10271-used-to-deliver-cryptominers.html"
        id = "e30e316f-1ebb-5c38-ba25-d2a9d0083a03"
    strings:
        $s1 = "<soapenv:Header"
        $s2 = "java.beans.XMLDecoder"
        $s3 = "void" fullword
        $s4 = "index="
        $s5 = "/array>"
        $s6 = "\"start\""
        $s7 = "work:WorkContext" nocase

    condition:
        filesize < 10KB
        and (uint32(0) == 0x616f733c or uint32(0) == 0x54534f50)  //'<soa' or 'POST'
        and all of ($s*)
}
YARA Detection Rule: VULN_Linux_Sudoers_Commands
Repository: Neo23x0/signature-base
Detects: Detects sudoers config with commands which might allow privilege escalation to root
Author: Arnim Rupp
Reference: https://gtfobins.github.io/

Pattern signatures:
$command1 = "/sh " ascii
		$command2 = "/bash " ascii
		$command3 = "/ksh " ascii
		$command4 = "/csh " ascii
		$command5 = "/tcpdump " ascii
		//$command6 = "/cat " ascii
		//$command7 = "/head " ascii
		$command8 = "/nano " ascii
		$command9 = "/pico " ascii
		$command10 = "/rview " ascii
		$command11 = "/vi " ascii
		$command12 = "/vim " ascii
		$command13 = "/rvi " ascii
		$command14 = "/rvim " ascii
		//$command15 = "/more " ascii
		$command16 = "/less " ascii
		$command17 = "/dd " ascii
		/* $command18 = "/mount " ascii prone to FPs */

Detection condition:
( filename == "sudoers" or filepath contains "/etc/sudoers.d" ) and 
		any of ($command*)

Full rule:
rule VULN_Linux_Sudoers_Commands {
	meta:
		description = "Detects sudoers config with commands which might allow privilege escalation to root"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		reference = "https://gtfobins.github.io/"
		date = "2022-11-22"
		modified = "2024-04-15"
		score = 50
		id = "221d90c8-e70e-5214-a03b-57ecabcdd480"
	strings:
		$command1 = "/sh " ascii
		$command2 = "/bash " ascii
		$command3 = "/ksh " ascii
		$command4 = "/csh " ascii
		$command5 = "/tcpdump " ascii
		//$command6 = "/cat " ascii
		//$command7 = "/head " ascii
		$command8 = "/nano " ascii
		$command9 = "/pico " ascii
		$command10 = "/rview " ascii
		$command11 = "/vi " ascii
		$command12 = "/vim " ascii
		$command13 = "/rvi " ascii
		$command14 = "/rvim " ascii
		//$command15 = "/more " ascii
		$command16 = "/less " ascii
		$command17 = "/dd " ascii
		/* $command18 = "/mount " ascii prone to FPs */ 

	condition:
		( filename == "sudoers" or filepath contains "/etc/sudoers.d" ) and 
		any of ($command*)
}
YARA Detection Rule: VULN_Linux_NFS_Exports
Repository: Neo23x0/signature-base
Detects: Detects insecure /etc/exports NFS config which might allow privilege escalation to root or other users. The parameter insecure allows any non-root user to mount NFS shares via e.g. an SSH-tunnel. With no_root_squash SUID root binaries are allowed.
Author: Arnim Rupp
Reference: https://www.errno.fr/nfs_privesc.html

Pattern signatures:
// line has to start with / to avoid triggering on #-comment lines
		$conf1 = /\n\/.{2,200}?\binsecure\b/ ascii
		$conf2 = /\n\/.{2,200}?\bno_root_squash\b/ ascii

Detection condition:
filename == "exports" and 
		filepath contains "/etc" and 
		any of ($conf*)

Full rule:
rule VULN_Linux_NFS_Exports {
	meta:
		description = "Detects insecure /etc/exports NFS config which might allow privilege escalation to root or other users. The parameter insecure allows any non-root user to mount NFS shares via e.g. an SSH-tunnel. With no_root_squash SUID root binaries are allowed."
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		reference = "https://www.errno.fr/nfs_privesc.html"
		author = "Arnim Rupp"
		date = "2022-11-22"
		score = 50
		id = "4b7d81d8-1ae1-5fcf-a91c-271477a839db"
	strings:
		// line has to start with / to avoid triggering on #-comment lines
		$conf1 = /\n\/.{2,200}?\binsecure\b/ ascii
		$conf2 = /\n\/.{2,200}?\bno_root_squash\b/ ascii

	condition:
		filename == "exports" and 
		filepath contains "/etc" and 
		any of ($conf*)
}
YARA Detection Rule: SUSP_AES_Key_in_MySql_History
Repository: Neo23x0/signature-base
Detects: Detects AES key outside of key management in .mysql_history
Author: Arnim Rupp

Pattern signatures:
$c1 = /\bAES_(DE|EN)CRYPT\(.{1,128}?,.??('|").{1,128}?('|")\)/ ascii
		$c2 = /\baes_(de|en)crypt\(.{1,128}?,.??('|").{1,128}?('|")\)/ ascii

Detection condition:
filename == ".mysql_history" and 
		any of ($c*)

Full rule:
rule SUSP_AES_Key_in_MySql_History {
	meta:
		description = "Detects AES key outside of key management in .mysql_history"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2022-11-22"
		score = 50
		id = "28acef39-8606-5d3d-b395-0d8db13f6c9c"
	strings:
		$c1 = /\bAES_(DE|EN)CRYPT\(.{1,128}?,.??('|").{1,128}?('|")\)/ ascii
		$c2 = /\baes_(de|en)crypt\(.{1,128}?,.??('|").{1,128}?('|")\)/ ascii

	condition:
		filename == ".mysql_history" and 
		any of ($c*)
}
YARA Detection Rule: VULN_Slapd_Conf_with_Default_Password
Repository: Neo23x0/signature-base
Detects: Detects an openldap slapd.conf with the default password test123
Author: Arnim Rupp
Reference: https://www.openldap.org/doc/admin21/slapdconfig.html

Pattern signatures:
/* \nrootpw \{SSHA\}fsAEyxlFOtvZBwPLAF68zpUhth8lERoR */
		$c1 = { 0A 72 6f 6f 74 70 77 20 7b 53 53 48 41 7d 66 73 41 45 79 78 6c 46 4f 74 76 5a 42 77 50 4c 41 46 36 38 7a 70 55 68 74 68 38 6c 45 52 6f 52 }

Detection condition:
filename == "slapd.conf" and 
		any of ($c*)

Full rule:
rule VULN_Slapd_Conf_with_Default_Password {
	meta:
		description = "Detects an openldap slapd.conf with the default password test123"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2022-11-22"
		reference = "https://www.openldap.org/doc/admin21/slapdconfig.html"
		score = 70
		id = "1d1319da-125b-5373-88f1-27a23c85729e"
	strings:
		/* \nrootpw \{SSHA\}fsAEyxlFOtvZBwPLAF68zpUhth8lERoR */
		$c1 = { 0A 72 6f 6f 74 70 77 20 7b 53 53 48 41 7d 66 73 41 45 79 78 6c 46 4f 74 76 5a 42 77 50 4c 41 46 36 38 7a 70 55 68 74 68 38 6c 45 52 6f 52 }

	condition:
		filename == "slapd.conf" and 
		any of ($c*)
}
YARA Detection Rule: MSIL_SUSP_OBFUSC_XorStringsNet
Repository: Neo23x0/signature-base
Detects: Detects XorStringsNET string encryption, and other obfuscators derived from it
Author: dr4k0nia
Reference: https://github.com/dr4k0nia/yara-rules

Pattern signatures:
$pattern = { 06 1E 58 07 8E 69 FE 17 }

        // .NET marker
        $a1 = "_CorDllMain" ascii
        $a2 = "_CorExeMain" ascii
        $a3 = "mscorlib" ascii fullword
        $a4 = ".cctor" ascii fullword
        $a5 = "System.Private.Corlib" ascii
        $a6 = "<Module>" ascii fullword
        $a7 = "<PrivateImplementationsDetails{" ascii

Detection condition:
uint16(0) == 0x5a4d
        and filesize < 25MB
        and $pattern 
        and 2 of ($a*)

Full rule:
rule MSIL_SUSP_OBFUSC_XorStringsNet {
    meta:
        description = "Detects XorStringsNET string encryption, and other obfuscators derived from it"
        author = "dr4k0nia"
        version = "1.0"
        reference = "https://github.com/dr4k0nia/yara-rules"
        score = 75
        date = "26/03/2023"
        id = "f0724ca6-4bfe-5b88-9396-a58aa7461fd6"
    strings:
        $pattern = { 06 1E 58 07 8E 69 FE 17 }

        // .NET marker
        $a1 = "_CorDllMain" ascii
        $a2 = "_CorExeMain" ascii
        $a3 = "mscorlib" ascii fullword
        $a4 = ".cctor" ascii fullword
        $a5 = "System.Private.Corlib" ascii
        $a6 = "<Module>" ascii fullword
        $a7 = "<PrivateImplementationsDetails{" ascii
    condition:
        uint16(0) == 0x5a4d
        and filesize < 25MB
        and $pattern 
        and 2 of ($a*)
}
YARA Detection Rule: Reveal_MemoryCredentials
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file Reveal-MemoryCredentials.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/giMini/RWMC/

Pattern signatures:
$s1 = "$dumpAProcessPath = \"C:\\Windows\\temp\\msdsc.exe\"" fullword ascii
		$s2 = "$user = Get-ADUser -Filter {UserPrincipalName -like $loginPlainText -or sAMAccountName -like $loginPlainText}" fullword ascii
		$s3 = "Copy-Item -Path \"\\\\$computername\\\\c$\\windows\\temp\\lsass.dmp\" -Destination \"$logDirectoryPath\"" fullword ascii
		$s4 = "if($backupOperatorsFlag -eq \"true\") {$loginPlainText = $loginPlainText + \" = Backup Operators\"}            " fullword ascii

Detection condition:
filesize < 200KB and 1 of them

Full rule:
rule Reveal_MemoryCredentials {
	meta:
		description = "Auto-generated rule - file Reveal-MemoryCredentials.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/giMini/RWMC/"
		date = "2015-08-31"
		hash = "893c26818c424d0ff549c1fbfa11429f36eecd16ee69330c442c59a82ce6adea"
		id = "ca06c702-45fe-5ab5-b53e-c3f7b7006570"
	strings:
		$s1 = "$dumpAProcessPath = \"C:\\Windows\\temp\\msdsc.exe\"" fullword ascii
		$s2 = "$user = Get-ADUser -Filter {UserPrincipalName -like $loginPlainText -or sAMAccountName -like $loginPlainText}" fullword ascii
		$s3 = "Copy-Item -Path \"\\\\$computername\\\\c$\\windows\\temp\\lsass.dmp\" -Destination \"$logDirectoryPath\"" fullword ascii
		$s4 = "if($backupOperatorsFlag -eq \"true\") {$loginPlainText = $loginPlainText + \" = Backup Operators\"}            " fullword ascii
	condition:
		filesize < 200KB and 1 of them
}
YARA Detection Rule: MiniDumpTest_msdsc
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file msdsc.exe
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/giMini/RWMC/

Pattern signatures:
$s1 = "MiniDumpTest1.exe" fullword wide
		$s2 = "MiniDumpWithTokenInformation" fullword ascii
		$s3 = "MiniDumpTest1" fullword wide
		$s6 = "Microsoft 2008" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 20KB and all of them

Full rule:
rule MiniDumpTest_msdsc {
	meta:
		description = "Auto-generated rule - file msdsc.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/giMini/RWMC/"
		date = "2015-08-31"
		hash = "[PII_REDACTED]18c433f521ba63d2df6a27cc40a5833a78497c11fb0994d2fd46ba"
		id = "044ae157-aba2-5935-9afc-8a12853c84bc"
	strings:
		$s1 = "MiniDumpTest1.exe" fullword wide
		$s2 = "MiniDumpWithTokenInformation" fullword ascii
		$s3 = "MiniDumpTest1" fullword wide
		$s6 = "Microsoft 2008" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 20KB and all of them
}
YARA Detection Rule: GhostDragon_Gh0stRAT_Sample2
Repository: Neo23x0/signature-base
Detects: Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report
Author: Florian Roth (Nextron Systems)
Reference: https://blog.cylance.com/the-ghost-dragon

Pattern signatures:
$x1 = "AdobeWpk" fullword ascii
		$x2 = "seekin.dll" fullword ascii

		$c1 = "Windows NT 6.1; Trident/6.0)" fullword ascii
		$c2 = "Mozilla/5.0 (compatible; MSIE 10.0; " fullword ascii

Detection condition:
(
			uint16(0) == 0x5a4d and filesize < 80KB and (
				all of ($x*) or all of ($c*)
			)
		) or ( all of them )

Full rule:
rule GhostDragon_Gh0stRAT_Sample2 {
	meta:
		description = "Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.cylance.com/the-ghost-dragon"
		date = "2016-04-23"
		hash1 = "71a52058f6b5cef66302c19169f67cf304507b4454cca83e2c36151da8da1d97"
		id = "424cb978-c4d1-5847-8852-e25ec2a02139"
	strings:
		$x1 = "AdobeWpk" fullword ascii
		$x2 = "seekin.dll" fullword ascii

		$c1 = "Windows NT 6.1; Trident/6.0)" fullword ascii
		$c2 = "Mozilla/5.0 (compatible; MSIE 10.0; " fullword ascii
	condition:
		(
			uint16(0) == 0x5a4d and filesize < 80KB and (
				all of ($x*) or all of ($c*)
			)
		) or ( all of them )
}
YARA Detection Rule: GhostDragon_Gh0stRAT_Sample3
Repository: Neo23x0/signature-base
Detects: Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report
Author: Florian Roth (Nextron Systems)
Reference: https://blog.cylance.com/the-ghost-dragon

Pattern signatures:
$op1 = { 44 24 15 65 88 54 24 16 c6 44 24 }
		$op2 = { 44 24 1b 43 c6 44 24 1c 75 88 54 24 1e }
		$op3 = { 1e 79 c6 44 24 1f 43 c6 44 24 20 75 88 54 24 22 }

Detection condition:
all of them

Full rule:
rule GhostDragon_Gh0stRAT_Sample3 {
	meta:
		description = "Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.cylance.com/the-ghost-dragon"
		date = "2016-04-23"
		hash1 = "1be9c68b[PII_REDACTED]8596a388010c9cfffadcb6e9841fb22de8b0dc2d161c42"
		id = "6d4bb99d-28de-59c2-b6f0-6da3cac4ed73"
	strings:
		$op1 = { 44 24 15 65 88 54 24 16 c6 44 24 }
		$op2 = { 44 24 1b 43 c6 44 24 1c 75 88 54 24 1e }
		$op3 = { 1e 79 c6 44 24 1f 43 c6 44 24 20 75 88 54 24 22 }
	condition:
		all of them
}