deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: CleanIISLog
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file CleanIISLog.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "CleanIP - Specify IP Address Which You Want Clear." fullword ascii
      $s2 = "LogFile - Specify Log File Which You Want Process." fullword ascii
      $s8 = "CleanIISLog Ver" fullword ascii
      $s9 = "msftpsvc" fullword ascii
      $s10 = "Fatal Error: MFC initialization failed" fullword ascii
      $s11 = "Specified \"ALL\" Will Process All Log Files." fullword ascii
      $s12 = "Specified \".\" Will Clean All IP Record." fullword ascii
      $s16 = "Service %s Stopped." fullword ascii
      $s20 = "Process Log File %s..." fullword ascii

Detection condition:
5 of them

Full rule:
rule CleanIISLog {
   meta:
      description = "Disclosed hacktool set (old stuff) - file CleanIISLog.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "827cd898bfe8aa7e9aaefbe949d26298f9e24094"
      id = "439726c6-3262-59ef-9a54-7dcd98cf924d"
   strings:
      $s1 = "CleanIP - Specify IP Address Which You Want Clear." fullword ascii
      $s2 = "LogFile - Specify Log File Which You Want Process." fullword ascii
      $s8 = "CleanIISLog Ver" fullword ascii
      $s9 = "msftpsvc" fullword ascii
      $s10 = "Fatal Error: MFC initialization failed" fullword ascii
      $s11 = "Specified \"ALL\" Will Process All Log Files." fullword ascii
      $s12 = "Specified \".\" Will Clean All IP Record." fullword ascii
      $s16 = "Service %s Stopped." fullword ascii
      $s20 = "Process Log File %s..." fullword ascii
   condition:
      5 of them
}
YARA Detection Rule: sqlcheck
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file sqlcheck.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Power by eyas<cooleyas@21cn.com>" fullword ascii
      $s3 = "\\ipc$ \"\" /user:\"\"" fullword ascii
      $s4 = "SQLCheck can only scan a class B network. Try again." fullword ascii
      $s14 = "Example: SQLCheck 192.168.0.1 192.168.0.254" fullword ascii
      $s20 = "Usage: SQLCheck <StartIP> <EndIP>" fullword ascii

Detection condition:
3 of them

Full rule:
rule sqlcheck {
   meta:
      description = "Disclosed hacktool set (old stuff) - file sqlcheck.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "5a5778ac200078b627db84fdc35bf5bcee232dc7"
      id = "a72d38ef-b2e7-5051-8538-724d9e95fa6a"
   strings:
      $s0 = "Power by eyas<cooleyas@21cn.com>" fullword ascii
      $s3 = "\\ipc$ \"\" /user:\"\"" fullword ascii
      $s4 = "SQLCheck can only scan a class B network. Try again." fullword ascii
      $s14 = "Example: SQLCheck 192.168.0.1 192.168.0.254" fullword ascii
      $s20 = "Usage: SQLCheck <StartIP> <EndIP>" fullword ascii
   condition:
      3 of them
}
YARA Detection Rule: sig_238_RunAsEx
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file RunAsEx.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "RunAsEx By Assassin 2000. All Rights Reserved. http://www.netXeyes.com" fullword ascii
      $s8 = "cmd.bat" fullword ascii
      $s9 = "Note: This Program Can'nt Run With Local Machine." fullword ascii
      $s11 = "%s Execute Succussifully." fullword ascii
      $s12 = "winsta0" fullword ascii
      $s15 = "Usage: RunAsEx <UserName> <Password> <Execute File> [\"Execute Option\"]" fullword ascii

Detection condition:
4 of them

Full rule:
rule sig_238_RunAsEx {
   meta:
      description = "Disclosed hacktool set (old stuff) - file RunAsEx.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "a22fa4e38d4bf82041d67b4ac5a6c655b2e98d35"
      id = "5fe349db-c0fc-5a49-97ee-3142f4e0e4c1"
   strings:
      $s0 = "RunAsEx By Assassin 2000. All Rights Reserved. http://www.netXeyes.com" fullword ascii
      $s8 = "cmd.bat" fullword ascii
      $s9 = "Note: This Program Can'nt Run With Local Machine." fullword ascii
      $s11 = "%s Execute Succussifully." fullword ascii
      $s12 = "winsta0" fullword ascii
      $s15 = "Usage: RunAsEx <UserName> <Password> <Execute File> [\"Execute Option\"]" fullword ascii
   condition:
      4 of them
}
YARA Detection Rule: sig_238_nbtdump
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file nbtdump.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Creation of results file - \"%s\" failed." fullword ascii
      $s1 = "c:\\>nbtdump remote-machine" fullword ascii
      $s7 = "Cerberus NBTDUMP" fullword ascii
      $s11 = "<CENTER><H1>Cerberus Internet Scanner</H1>" fullword ascii
      $s18 = "<P><H3>Account Information</H3><PRE>" fullword wide
      $s19 = "%s's password is %s</H3>" fullword wide
      $s20 = "%s's password is blank</H3>" fullword wide

Detection condition:
5 of them

Full rule:
rule sig_238_nbtdump {
   meta:
      description = "Disclosed hacktool set (old stuff) - file nbtdump.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "cfe82aad5fc4d79cf3f551b9b12eaf9889ebafd8"
      id = "fe490f72-a07d-57c2-b9bb-d791fab10ec6"
   strings:
      $s0 = "Creation of results file - \"%s\" failed." fullword ascii
      $s1 = "c:\\>nbtdump remote-machine" fullword ascii
      $s7 = "Cerberus NBTDUMP" fullword ascii
      $s11 = "<CENTER><H1>Cerberus Internet Scanner</H1>" fullword ascii
      $s18 = "<P><H3>Account Information</H3><PRE>" fullword wide
      $s19 = "%s's password is %s</H3>" fullword wide
      $s20 = "%s's password is blank</H3>" fullword wide
   condition:
      5 of them
}
YARA Detection Rule: sig_238_Glass2k
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file Glass2k.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Portions Copyright (c) 1997-1999 Lee Hasiuk" fullword ascii
      $s1 = "C:\\Program Files\\Microsoft Visual Studio\\VB98" fullword ascii
      $s3 = "WINNT\\System32\\stdole2.tlb" fullword ascii
      $s4 = "Glass2k.exe" fullword wide
      $s7 = "NeoLite Executable File Compressor" fullword ascii

Detection condition:
all of them

Full rule:
rule sig_238_Glass2k {
   meta:
      description = "Disclosed hacktool set (old stuff) - file Glass2k.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "b05455a1ecc6bc7fc8ddef312a670f2013704f1a"
      id = "7a2ad37a-6b55-5710-b07d-7c289cdbb04e"
   strings:
      $s0 = "Portions Copyright (c) 1997-1999 Lee Hasiuk" fullword ascii
      $s1 = "C:\\Program Files\\Microsoft Visual Studio\\VB98" fullword ascii
      $s3 = "WINNT\\System32\\stdole2.tlb" fullword ascii
      $s4 = "Glass2k.exe" fullword wide
      $s7 = "NeoLite Executable File Compressor" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: SplitJoin_V1_3_3_rar_Folder_3
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file splitjoin.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s2 = "ie686@sohu.com" fullword ascii
      $s3 = "splitjoin.exe" fullword ascii
      $s7 = "SplitJoin" fullword ascii

Detection condition:
all of them

Full rule:
rule SplitJoin_V1_3_3_rar_Folder_3 {
   meta:
      description = "Disclosed hacktool set (old stuff) - file splitjoin.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "21409117b536664a913dcd159d6f4d8758f43435"
      id = "4ffd7501-339c-52b7-8661-2c3ca57dfa1f"
   strings:
      $s2 = "ie686@sohu.com" fullword ascii
      $s3 = "splitjoin.exe" fullword ascii
      $s7 = "SplitJoin" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: aspbackdoor_EDIT
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file EDIT.ASP
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "<meta HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html;charset=gb_2312-80\">" fullword ascii
      $s2 = "Set thisfile = fs.GetFile(whichfile)" fullword ascii
      $s3 = "response.write \"<a href='index.asp'>" fullword ascii
      $s5 = "if Request.Cookies(\"password\")=\"juchen\" then " fullword ascii
      $s6 = "Set thisfile = fs.OpenTextFile(whichfile, 1, False)" fullword ascii
      $s7 = "color: rgb(255,0,0); text-decoration: underline }" fullword ascii
      $s13 = "if Request(\"creat\")<>\"yes\" then" fullword ascii

Detection condition:
5 of them

Full rule:
rule aspbackdoor_EDIT {
   meta:
      description = "Disclosed hacktool set (old stuff) - file EDIT.ASP"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "12196cf62931cde7b6cb979c07bb5cc6a7535cbb"
      id = "cdcec370-97af-51c0-b81a-35a788f16ef4"
   strings:
      $s1 = "<meta HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html;charset=gb_2312-80\">" fullword ascii
      $s2 = "Set thisfile = fs.GetFile(whichfile)" fullword ascii
      $s3 = "response.write \"<a href='index.asp'>" fullword ascii
      $s5 = "if Request.Cookies(\"password\")=\"juchen\" then " fullword ascii
      $s6 = "Set thisfile = fs.OpenTextFile(whichfile, 1, False)" fullword ascii
      $s7 = "color: rgb(255,0,0); text-decoration: underline }" fullword ascii
      $s13 = "if Request(\"creat\")<>\"yes\" then" fullword ascii
   condition:
      5 of them
}
YARA Detection Rule: aspbackdoor_entice
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file entice.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "<Form Name=\"FormPst\" Method=\"Post\" Action=\"entice.asp\">" fullword ascii
      $s2 = "if left(trim(request(\"sqllanguage\")),6)=\"select\" then" fullword ascii
      $s4 = "conndb.Execute(sqllanguage)" fullword ascii
      $s5 = "<!--#include file=sqlconn.asp-->" fullword ascii
      $s6 = "rstsql=\"select * from \"&rstable(\"table_name\")" fullword ascii

Detection condition:
all of them

Full rule:
rule aspbackdoor_entice {
   meta:
      description = "Disclosed hacktool set (old stuff) - file entice.asp"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "e273a1b9ef4a00ae4a5d435c3c9c99ee887cb183"
      id = "68c61920-9c3c-5bfe-976c-346b258bb406"
   strings:
      $s0 = "<Form Name=\"FormPst\" Method=\"Post\" Action=\"entice.asp\">" fullword ascii
      $s2 = "if left(trim(request(\"sqllanguage\")),6)=\"select\" then" fullword ascii
      $s4 = "conndb.Execute(sqllanguage)" fullword ascii
      $s5 = "<!--#include file=sqlconn.asp-->" fullword ascii
      $s6 = "rstsql=\"select * from \"&rstable(\"table_name\")" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: FPipe2_0
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file FPipe2.0.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "made to port 80 of the remote machine at 192.168.1.101 with the" fullword ascii
      $s1 = "Unable to resolve hostname \"%s\"" fullword ascii
      $s2 = " -s    - outbound connection source port number" fullword ascii
      $s3 = "source port for that outbound connection being set to 53 also." fullword ascii
      $s4 = "http://www.foundstone.com" fullword ascii
      $s19 = "FPipe" fullword ascii

Detection condition:
all of them

Full rule:
rule FPipe2_0 {
   meta:
      description = "Disclosed hacktool set (old stuff) - file FPipe2.0.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "891609db7a[PII_REDACTED]154e7aab7757e74d837b"
      id = "7e104cf6-69d2-590e-8999-4f0d448719f2"
   strings:
      $s0 = "made to port 80 of the remote machine at 192.168.1.101 with the" fullword ascii
      $s1 = "Unable to resolve hostname \"%s\"" fullword ascii
      $s2 = " -s    - outbound connection source port number" fullword ascii
      $s3 = "source port for that outbound connection being set to 53 also." fullword ascii
      $s4 = "http://www.foundstone.com" fullword ascii
      $s19 = "FPipe" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: InstGina
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file InstGina.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "To Open Registry" fullword ascii
      $s4 = "I love Candy very much!!" ascii
      $s5 = "GinaDLL" fullword ascii

Detection condition:
all of them

Full rule:
rule InstGina {
   meta:
      description = "Disclosed hacktool set (old stuff) - file InstGina.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "5317fbc[PII_REDACTED]4246ef4241e78da41a4f31c"
      id = "ccbda689-e61a-501d-a8ed-62e3c1c20289"
   strings:
      $s0 = "To Open Registry" fullword ascii
      $s4 = "I love Candy very much!!" ascii
      $s5 = "GinaDLL" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: ArtTray_zip_Folder_ArtTray
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file ArtTray.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "http://www.brigsoft.com" fullword wide
      $s2 = "ArtTrayHookDll.dll" fullword ascii
      $s3 = "ArtTray Version 1.0 " fullword wide
      $s16 = "TRM_HOOKCALLBACK" fullword ascii

Detection condition:
all of them

Full rule:
rule ArtTray_zip_Folder_ArtTray {
   meta:
      description = "Disclosed hacktool set (old stuff) - file ArtTray.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "ee1edc8c4458c71573b5f555d32043cbc600a120"
      id = "d29909a4-8663-54c7-8f0e-68b15def869f"
   strings:
      $s0 = "http://www.brigsoft.com" fullword wide
      $s2 = "ArtTrayHookDll.dll" fullword ascii
      $s3 = "ArtTray Version 1.0 " fullword wide
      $s16 = "TRM_HOOKCALLBACK" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: sig_238_findoor
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file findoor.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "(non-Win32 .EXE or error in .EXE image)." fullword ascii
      $s8 = "PASS hacker@hacker.com" fullword ascii
      $s9 = "/scripts/..%c1%1c../winnt/system32/cmd.exe" fullword ascii
      $s10 = "MAIL FROM:hacker@hacker.com" fullword ascii
      $s11 = "http://isno.yeah.net" fullword ascii

Detection condition:
4 of them

Full rule:
rule sig_238_findoor {
   meta:
      description = "Disclosed hacktool set (old stuff) - file findoor.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "cdb1ececceade0ecdd4479ecf55b0cc1cf11cdce"
      id = "61215a76-8c29-505d-bfef-a5f13fec476c"
   strings:
      $s0 = "(non-Win32 .EXE or error in .EXE image)." fullword ascii
      $s8 = "PASS hacker@hacker.com" fullword ascii
      $s9 = "/scripts/..%c1%1c../winnt/system32/cmd.exe" fullword ascii
      $s10 = "MAIL FROM:hacker@hacker.com" fullword ascii
      $s11 = "http://isno.yeah.net" fullword ascii
   condition:
      4 of them
}
YARA Detection Rule: aspbackdoor_ipclear
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file ipclear.vbs
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Set ServiceObj = GetObject(\"WinNT://\" & objNet.ComputerName & \"/w3svc\")" fullword ascii
      $s1 = "wscript.Echo \"USAGE:KillLog.vbs LogFileName YourIP.\"" fullword ascii
      $s2 = "Set txtStreamOut = fso.OpenTextFile(destfile, ForWriting, True)" fullword ascii
      $s3 = "Set objNet = WScript.CreateObject( \"WScript.Network\" )" fullword ascii
      $s4 = "Set fso = CreateObject(\"Scripting.FileSystemObject\")" fullword ascii

Detection condition:
all of them

Full rule:
rule aspbackdoor_ipclear {
   meta:
      description = "Disclosed hacktool set (old stuff) - file ipclear.vbs"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "9f8fdfde4b729516330eaeb9141fb2a7ff7d0098"
      id = "71ebecea-721f-5c5d-9997-6a57f070d91c"
   strings:
      $s0 = "Set ServiceObj = GetObject(\"WinNT://\" & objNet.ComputerName & \"/w3svc\")" fullword ascii
      $s1 = "wscript.Echo \"USAGE:KillLog.vbs LogFileName YourIP.\"" fullword ascii
      $s2 = "Set txtStreamOut = fso.OpenTextFile(destfile, ForWriting, True)" fullword ascii
      $s3 = "Set objNet = WScript.CreateObject( \"WScript.Network\" )" fullword ascii
      $s4 = "Set fso = CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: WinEggDropShellFinal_zip_Folder_InjectT
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file InjectT.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Packed by exe32pack" ascii
      $s1 = "2TInject.Dll" fullword ascii
      $s2 = "Windows Services" fullword ascii
      $s3 = "Findrst6" fullword ascii
      $s4 = "Press Any Key To Continue......" fullword ascii

Detection condition:
all of them

Full rule:
rule WinEggDropShellFinal_zip_Folder_InjectT {
   meta:
      description = "Disclosed hacktool set (old stuff) - file InjectT.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "516e80e4a25660954de8c12313e2d7642bdb79dd"
      id = "16f04551-050f-5a07-a35b-a3a7dbba6803"
   strings:
      $s0 = "Packed by exe32pack" ascii
      $s1 = "2TInject.Dll" fullword ascii
      $s2 = "Windows Services" fullword ascii
      $s3 = "Findrst6" fullword ascii
      $s4 = "Press Any Key To Continue......" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: gina_zip_Folder_gina
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file gina.dll
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "NEWGINA.dll" fullword ascii
      $s1 = "LOADER ERROR" fullword ascii
      $s3 = "WlxActivateUserShell" fullword ascii
      $s6 = "WlxWkstaLockedSAS" fullword ascii
      $s13 = "WlxIsLockOk" fullword ascii
      $s14 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
      $s16 = "WlxShutdown" fullword ascii
      $s17 = "The ordinal %u could not be located in the dynamic link library %s" fullword ascii

Detection condition:
all of them

Full rule:
rule gina_zip_Folder_gina {
   meta:
      description = "Disclosed hacktool set (old stuff) - file gina.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "e0429e1b59989cbab6646ba905ac312710f5ed30"
      id = "7ebc7218-9c7b-5595-ae7b-f316fc99d1f6"
   strings:
      $s0 = "NEWGINA.dll" fullword ascii
      $s1 = "LOADER ERROR" fullword ascii
      $s3 = "WlxActivateUserShell" fullword ascii
      $s6 = "WlxWkstaLockedSAS" fullword ascii
      $s13 = "WlxIsLockOk" fullword ascii
      $s14 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
      $s16 = "WlxShutdown" fullword ascii
      $s17 = "The ordinal %u could not be located in the dynamic link library %s" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: superscan3_0
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file superscan3.0.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "\\scanner.ini" ascii
      $s1 = "\\scanner.exe" ascii
      $s2 = "\\scanner.lst" ascii
      $s4 = "\\hensss.lst" ascii
      $s5 = "STUB32.EXE" fullword wide
      $s6 = "STUB.EXE" fullword wide
      $s8 = "\\ws2check.exe" ascii
      $s9 = "\\trojans.lst" ascii
      $s10 = "1996 InstallShield Software Corporation" fullword wide

Detection condition:
all of them

Full rule:
rule superscan3_0 {
   meta:
      description = "Disclosed hacktool set (old stuff) - file superscan3.0.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "a9a02a14ea4e78af30b8b4a7e1c6ed500a36bc4d"
      id = "d22aa3ae-4c62-5007-896d-7c473f0421a6"
   strings:
      $s0 = "\\scanner.ini" ascii
      $s1 = "\\scanner.exe" ascii
      $s2 = "\\scanner.lst" ascii
      $s4 = "\\hensss.lst" ascii
      $s5 = "STUB32.EXE" fullword wide
      $s6 = "STUB.EXE" fullword wide
      $s8 = "\\ws2check.exe" ascii
      $s9 = "\\trojans.lst" ascii
      $s10 = "1996 InstallShield Software Corporation" fullword wide
   condition:
      all of them
}
YARA Detection Rule: sig_238_xsniff
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file xsniff.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s2 = "xsiff.exe -pass -hide -log pass.log" fullword ascii
      $s3 = "%s - simple sniffer for win2000" fullword ascii
      $s4 = "xsiff.exe -tcp -udp -asc -addr 192.168.1.1" fullword ascii
      $s5 = "HOST: %s USER: %s, PASS: %s" fullword ascii
      $s7 = "http://www.xfocus.org" fullword ascii
      $s9 = "  -pass        : Filter username/password" fullword ascii
      $s18 = "  -udp         : Output udp packets" fullword ascii
      $s19 = "Code by glacier <glacier@xfocus.org>" fullword ascii
      $s20 = "  -tcp         : Output tcp packets" fullword ascii

Detection condition:
6 of them

Full rule:
rule sig_238_xsniff {
   meta:
      description = "Disclosed hacktool set (old stuff) - file xsniff.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "d61d7329ac74f66245a92c4505a327c85875c577"
      id = "1e61a732-8691-5f84-beb0-c9f7e6d46538"
   strings:
      $s2 = "xsiff.exe -pass -hide -log pass.log" fullword ascii
      $s3 = "%s - simple sniffer for win2000" fullword ascii
      $s4 = "xsiff.exe -tcp -udp -asc -addr 192.168.1.1" fullword ascii
      $s5 = "HOST: %s USER: %s, PASS: %s" fullword ascii
      $s7 = "http://www.xfocus.org" fullword ascii
      $s9 = "  -pass        : Filter username/password" fullword ascii
      $s18 = "  -udp         : Output udp packets" fullword ascii
      $s19 = "Code by glacier <glacier@xfocus.org>" fullword ascii
      $s20 = "  -tcp         : Output tcp packets" fullword ascii
   condition:
      6 of them
}