deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EquationGroup_Toolset_Apr17__ESKE_RPC2_8
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s4 = "Fragment: Packet too small to contain RPC header" fullword ascii
      $s5 = "Fragment pickup: SmbNtReadX failed" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 700KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17__ESKE_RPC2_8 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      super_rule = 1
      hash1 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
      hash2 = "5c0896dbafc5d8cc19b1bc7924420b20ed5999ac5bee2cb5a91aada0ea01e337"
   strings:
      $s4 = "Fragment: Packet too small to contain RPC header" fullword ascii
      $s5 = "Fragment pickup: SmbNtReadX failed" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 700KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17__LSADUMP_Lp_ModifyPrivilege_Lp_PacketScan_Lp_put_Lp_RemoteExecute_Lp_Windows_Lp_wmi_Lp_9
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "Injection Lib -  " wide
      $x2 = "LSADUMP - - ERROR" wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17__LSADUMP_Lp_ModifyPrivilege_Lp_PacketScan_Lp_put_Lp_RemoteExecute_Lp_Windows_Lp_wmi_Lp_9 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      super_rule = 1
      hash1 = "c7bf4c012293e7de56d86f4f5b4eeb6c1c5263568cc4d9863a286a86b5daf194"
      hash2 = "d92928a867a685274b0a74ec55c0b83690fca[PII_REDACTED]79e184e2787d47f48"
      hash3 = "2d963529e6db733c5b74db1894d75493507e6e40da0de2f33e301959b50f3d32"
      hash4 = "e9f6a84899c9a042edbbff391ca076169da1a6f6dfb61b927942fe4be3327749"
      hash5 = "d989d610b032c72252a2df284d0b53f63f382e305de2a18b453a0510ab6246a3"
      hash6 = "23d98bca1f6e2f6989d53c2f2adff996ede2c961ea189744f8ae65621003b8b1"
      hash7 = "d7ae24816fda190feda6a60639cf3716ea00fb63a4bd1069b8ce52d10ad8bc7f"
   strings:
      $x1 = "Injection Lib -  " wide
      $x2 = "LSADUMP - - ERROR" wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17__ETBL_ETRE_10
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "Probe #2 usage: %s -i TargetIp -p TargetPort -r %d [-o TimeOut] -t Protocol -n IMailUserName -a IMailPassword" fullword ascii
      $x6 = "** RunExploit ** - EXCEPTION_EXECUTE_HANDLER : 0x%08X" fullword ascii
      $s19 = "Sending Implant Payload.. cEncImplantPayload size(%d)" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17__ETBL_ETRE_10 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      super_rule = 1
      hash1 = "70db3ac2c1a10de6ce6b3e7a7890c37bffde006ea6d441f5de6d8329add4d2ef"
      hash2 = "e0f05f26293e3231e4e32916ad8a6ee944af842410c194fce8a0d8ad2f5c54b2"
   strings:
      $x1 = "Probe #2 usage: %s -i TargetIp -p TargetPort -r %d [-o TimeOut] -t Protocol -n IMailUserName -a IMailPassword" fullword ascii
      $x6 = "** RunExploit ** - EXCEPTION_EXECUTE_HANDLER : 0x%08X" fullword ascii
      $s19 = "Sending Implant Payload.. cEncImplantPayload size(%d)" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17__ELV_ESKE_ETBL_ETRE_EVFR_11
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "Target is vulnerable" fullword ascii
      $x2 = "Target is NOT vulnerable" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17__ELV_ESKE_ETBL_ETRE_EVFR_11 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      super_rule = 1
      hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
      hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
      hash3 = "70db3ac2c1a10de6ce6b3e7a7890c37bffde006ea6d441f5de6d8329add4d2ef"
      hash4 = "e0f05f26293e3231e4e32916ad8a6ee944af842410c194fce8a0d8ad2f5c54b2"
      hash5 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
   strings:
      $x1 = "Target is vulnerable" fullword ascii
      $x2 = "Target is NOT vulnerable" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_RideArea2_12
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x2 = "** CreatePayload ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_RideArea2_12 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      super_rule = 1
      hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
      hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
      hash3 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
      hash4 = "e702223ab42c54fff96f198611d0b2e8a1ceba40586d466ba9aadfa2fd34386e"
   strings:
      $x2 = "** CreatePayload ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17__ELV_ESKE_13
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "Skip call to PackageRideArea().  Payload has already been packaged. Options -x and -q ignored." fullword ascii
      $s2 = "ERROR: pGvars->pIntRideAreaImplantPayload is NULL" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 600KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17__ELV_ESKE_13 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      super_rule = 1
      hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
      hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
   strings:
      $x1 = "Skip call to PackageRideArea().  Payload has already been packaged. Options -x and -q ignored." fullword ascii
      $s2 = "ERROR: pGvars->pIntRideAreaImplantPayload is NULL" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 600KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17__NameProbe_SMBTOUCH_14
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "DEC Pathworks TCPIP service on Windows NT" fullword ascii
      $s2 = "<\\\\__MSBROWSE__> G" fullword ascii
      $s3 = "<IRISNAMESERVER>" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17__NameProbe_SMBTOUCH_14 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      super_rule = 1
      hash1 = "fbe3a[PII_REDACTED]f502a93f51b298ff3abf4e4cad34ce4ec0fad5cb5c2071597"
      hash2 = "7da350c964ea43c149a12ac3d2ce4675cedc079ddc10d1f7c464b[PII_REDACTED]"
   strings:
      $s1 = "DEC Pathworks TCPIP service on Windows NT" fullword ascii
      $s2 = "<\\\\__MSBROWSE__> G" fullword ascii
      $s3 = "<IRISNAMESERVER>" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_RPC2_15
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "** SendAndReceive ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
      $s8 = "Binding to RPC Interface %s over named pipe" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_RPC2_15 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      super_rule = 1
      hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
      hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
      hash3 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
      hash4 = "5c0896dbafc5d8cc19b1bc7924420b20ed5999ac5bee2cb5a91aada0ea01e337"
   strings:
      $x1 = "** SendAndReceive ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
      $s8 = "Binding to RPC Interface %s over named pipe" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_16
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "ERROR: TbMalloc() failed for encoded exploit payload" fullword ascii
      $x2 = "** EncodeExploitPayload ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
      $x4 = "** RunExploit ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
      $s6 = "Sending Implant Payload (%d-bytes)" fullword ascii
      $s7 = "ERROR: Encoder failed on exploit payload" fullword ascii
      $s11 = "ERROR: VulnerableOS() != RET_SUCCESS" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_16 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      super_rule = 1
      hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
      hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
      hash3 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
   strings:
      $x1 = "ERROR: TbMalloc() failed for encoded exploit payload" fullword ascii
      $x2 = "** EncodeExploitPayload ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
      $x4 = "** RunExploit ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
      $s6 = "Sending Implant Payload (%d-bytes)" fullword ascii
      $s7 = "ERROR: Encoder failed on exploit payload" fullword ascii
      $s11 = "ERROR: VulnerableOS() != RET_SUCCESS" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17__ETBL_ETRE_SMBTOUCH_17
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "ERROR: Connection terminated by Target (TCP Ack/Fin)" fullword ascii
      $s2 = "Target did not respond within specified amount of time" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17__ETBL_ETRE_SMBTOUCH_17 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      super_rule = 1
      hash1 = "70db3ac2c1a10de6ce6b3e7a7890c37bffde006ea6d441f5de6d8329add4d2ef"
      hash2 = "e0f05f26293e3231e4e32916ad8a6ee944af842410c194fce8a0d8ad2f5c54b2"
      hash3 = "7da350c964ea43c149a12ac3d2ce4675cedc079ddc10d1f7c464b[PII_REDACTED]"
   strings:
      $x1 = "ERROR: Connection terminated by Target (TCP Ack/Fin)" fullword ascii
      $s2 = "Target did not respond within specified amount of time" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them )
}
YARA Detection Rule: EquationGroup_scanner_output
Repository: Yara-Rules/rules
Detects: Detects output generated by EQGRP scanner.exe
Author: Florian Roth
Reference: Internal Research

Pattern signatures:
$s1 = "# Scan for windows boxes" ascii fullword
      $s2 = "Going into send" ascii fullword
      $s3 = "# Does not work" ascii fullword
      $s4 = "You are the weakest link, goodbye" ascii fullword
      $s5 = "rpc   Scan for RPC  folks" ascii fullword

Detection condition:
filesize < 1000KB and 2 of them

Full rule:
rule EquationGroup_scanner_output {
   meta:
      description = "Detects output generated by EQGRP scanner.exe"
      author = "Florian Roth"
      reference = "Internal Research"
      date = "2017-04-17"
   strings:
      $s1 = "# Scan for windows boxes" ascii fullword
      $s2 = "Going into send" ascii fullword
      $s3 = "# Does not work" ascii fullword
      $s4 = "You are the weakest link, goodbye" ascii fullword
      $s5 = "rpc   Scan for RPC  folks" ascii fullword
   condition:
      filesize < 1000KB and 2 of them
}
YARA Detection Rule: PolishBankRAT_srservice_xorloop
Repository: Yara-Rules/rules
Detects: Finds the custom xor decode loop for <PolishBankRAT_srservice>
Author: Booz Allen Hamilton Dark Labs

Pattern signatures:
$loop = { 48 8B CD E8 60 FF FF FF 48 FF C3 32 44 1E FF 48 FF CF 88 43 FF }

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $loop

Full rule:
rule PolishBankRAT_srservice_xorloop 
{
	meta:
	
		author = "Booz Allen Hamilton Dark Labs"
		description = "Finds the custom xor decode loop for <PolishBankRAT_srservice>"
	
	strings:

		$loop = { 48 8B CD E8 60 FF FF FF 48 FF C3 32 44 1E FF 48 FF CF 88 43 FF }

	condition:

		(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $loop
}
YARA Detection Rule: PolishBankRAT_fdsvc_xor_loop
Repository: Yara-Rules/rules
Detects: Finds the custom xor decode loop for <PolishBankRAT_fdsvc>
Author: Booz Allen Hamilton Dark Labs

Pattern signatures:
$loop = {0F B6 42 FF 48 8D 52 FF 30 42 01 FF CF 75 F1}

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $loop

Full rule:
rule PolishBankRAT_fdsvc_xor_loop 
{
	meta:

		author = "Booz Allen Hamilton Dark Labs"
		description = "Finds the custom xor decode loop for <PolishBankRAT_fdsvc>"

	strings:

		$loop = {0F B6 42 FF 48 8D 52 FF 30 42 01 FF CF 75 F1}

	condition:

		(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $loop
}
YARA Detection Rule: PolishBankRAT_fdsvc_decode2
Repository: Yara-Rules/rules
Detects: Find a constant used as part of a payload decoding function in PolishBankRAT_fdsvc
Author: Booz Allen Hamilton Dark Labs

Pattern signatures:
$part1 = {A6 EB 96}
		$part2 = {61 B2 E2 EF}
		$part3 = {0D CB E8 C4}
		$part4 = {5A F1 66 9C}
		$part5 = {A4 80 CD 9A}
		$part6 = {F1 2F 46 25}
		$part7 = {2F DB 16 26}
		$part8 = {4B C4 3F 3C}
		$str1 = "This program cannot be run in DOS mode"

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule PolishBankRAT_fdsvc_decode2 
{
	meta:
		
		author = "Booz Allen Hamilton Dark Labs"
		description = "Find a constant used as part of a payload decoding function in PolishBankRAT_fdsvc"

	strings:
		
		$part1 = {A6 EB 96}
		$part2 = {61 B2 E2 EF}
		$part3 = {0D CB E8 C4}
		$part4 = {5A F1 66 9C}
		$part5 = {A4 80 CD 9A}
		$part6 = {F1 2F 46 25}
		$part7 = {2F DB 16 26}
		$part8 = {4B C4 3F 3C}
		$str1 = "This program cannot be run in DOS mode"

	condition:

		(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: decoded_PolishBankRAT_fdsvc_strings
Repository: Yara-Rules/rules
Detects: Finds hard coded strings in PolishBankRAT_fdsvc
Author: Booz Allen Hamilton Dark Labs

Pattern signatures:
$str1 = "ssylka" wide ascii
		$str2 = "ustanavlivat" wide ascii
		$str3 = "poluchit" wide ascii
		$str4 = "pereslat" wide ascii
		$str5 = "derzhat" wide ascii
		$str6 = "vykhodit" wide ascii
		$str7 = "Nachalo" wide ascii

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and 4 of ($str*)

Full rule:
rule decoded_PolishBankRAT_fdsvc_strings 
{
	meta:

		author = "Booz Allen Hamilton Dark Labs"
		description = "Finds hard coded strings in PolishBankRAT_fdsvc"

	strings:

		$str1 = "ssylka" wide ascii
		$str2 = "ustanavlivat" wide ascii
		$str3 = "poluchit" wide ascii
		$str4 = "pereslat" wide ascii
		$str5 = "derzhat" wide ascii
		$str6 = "vykhodit" wide ascii
		$str7 = "Nachalo" wide ascii

	condition:
		
		(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and 4 of ($str*)
}
YARA Detection Rule: apt_nix_elf_derusbi
Repository: Yara-Rules/rules
Author: @seifreed

Pattern signatures:
$ = "LxMain"
        $ = "execve"
        $ = "kill"
        $ = "cp -a %s %s"
        $ = "%s &"
        $ = "dbus-daemon"
        $ = "--noprofile"
        $ = "--norc"
        $ = "TERM=vt100"
        $ = "/proc/%u/cmdline"
        $ = "loadso"
        $ = "/proc/self/exe"
        $ = "Proxy-Connection: Keep-Alive"
        $ = "Connection: Keep-Alive"
        $ = "CONNECT %s"
        $ = "HOST: %s:%d"
        $ = "User-Agent: Mozilla/4.0"
        $ = "Proxy-Authorization: Basic %s"
        $ = "Server: Apache"
        $ = "Proxy-Authenticate"
        $ = "gettimeofday"
        $ = "pthread_create"
        $ = "pthread_join"
        $ = "pthread_mutex_init"
        $ = "pthread_mutex_destroy"
        $ = "pthread_mutex_lock"
        $ = "getsockopt"
        $ = "socket"
        $ = "setsockopt"
        $ = "select"
        $ = "bind"
        $ = "shutdown"
        $ = "listen"
        $ = "opendir"
        $ = "readdir"
        $ = "closedir"
        $ = "rename"

Detection condition:
(uint32(0) == 0x4464c457f) and (all of them)

Full rule:
rule apt_nix_elf_derusbi
{

    meta:
        Author = "@seifreed"

    strings:
        $ = "LxMain"
        $ = "execve"
        $ = "kill"
        $ = "cp -a %s %s"
        $ = "%s &"
        $ = "dbus-daemon"
        $ = "--noprofile"
        $ = "--norc"
        $ = "TERM=vt100"
        $ = "/proc/%u/cmdline"
        $ = "loadso"
        $ = "/proc/self/exe"
        $ = "Proxy-Connection: Keep-Alive"
        $ = "Connection: Keep-Alive"
        $ = "CONNECT %s"
        $ = "HOST: %s:%d"
        $ = "User-Agent: Mozilla/4.0"
        $ = "Proxy-Authorization: Basic %s"
        $ = "Server: Apache"
        $ = "Proxy-Authenticate"
        $ = "gettimeofday"
        $ = "pthread_create"
        $ = "pthread_join"
        $ = "pthread_mutex_init"
        $ = "pthread_mutex_destroy"
        $ = "pthread_mutex_lock"
        $ = "getsockopt"
        $ = "socket"
        $ = "setsockopt"
        $ = "select"
        $ = "bind"
        $ = "shutdown"
        $ = "listen"
        $ = "opendir"
        $ = "readdir"
        $ = "closedir"
        $ = "rename"

    condition:
        (uint32(0) == 0x4464c457f) and (all of them)
}
YARA Detection Rule: apt_nix_elf_derusbi_kernelModule
Repository: Yara-Rules/rules
Author: @seifreed

Pattern signatures:
$ = "__this_module"
        $ = "init_module"
        $ = "unhide_pid"
        $ = "is_hidden_pid"
        $ = "clear_hidden_pid"
        $ = "hide_pid"
        $ = "license"
        $ = "description"
        $ = "srcversion="
        $ = "depends="
        $ = "vermagic="
        $ = "current_task"
        $ = "sock_release"
        $ = "module_layout"
        $ = "init_uts_ns"
        $ = "init_net"
        $ = "init_task"
        $ = "filp_open"
        $ = "__netlink_kernel_create"
        $ = "kfree_skb"

Detection condition:
(uint32(0) == 0x4464c457f) and (all of them)

Full rule:
rule apt_nix_elf_derusbi_kernelModule
{

    meta:
        Author = "@seifreed"

    strings:
        $ = "__this_module"
        $ = "init_module"
        $ = "unhide_pid"
        $ = "is_hidden_pid"
        $ = "clear_hidden_pid"
        $ = "hide_pid"
        $ = "license"
        $ = "description"
        $ = "srcversion="
        $ = "depends="
        $ = "vermagic="
        $ = "current_task"
        $ = "sock_release"
        $ = "module_layout"
        $ = "init_uts_ns"
        $ = "init_net"
        $ = "init_task"
        $ = "filp_open"
        $ = "__netlink_kernel_create"
        $ = "kfree_skb"

    condition:
        (uint32(0) == 0x4464c457f) and (all of them)
}
YARA Detection Rule: apt_nix_elf_Derusbi_Linux_SharedMemCreation
Repository: Yara-Rules/rules
Author: @seifreed

Pattern signatures:
$byte1 = { B6 03 00 00 ?? 40 00 00 00 ?? 0D 5F 01 82 }

Detection condition:
(uint32(0) == 0x464C457F) and (any of them)

Full rule:
rule apt_nix_elf_Derusbi_Linux_SharedMemCreation
{

    meta:
        Author = "@seifreed"

    strings:
        $byte1 = { B6 03 00 00 ?? 40 00 00 00 ?? 0D 5F 01 82 }

    condition:
        (uint32(0) == 0x464C457F) and (any of them)
}