deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: RAT_ShadowTech
Repository: Neo23x0/signature-base
Detects: Detects ShadowTech RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/ShadowTech

Pattern signatures:
$a = "ShadowTech" nocase
		$b = "DownloadContainer"
		$c = "MySettings"
		$d = "System.Configuration"
		$newline = "#-@NewLine@-#" wide
		$split = "pSIL" wide
		$key = "ESIL" wide

Detection condition:
4 of them

Full rule:
rule RAT_ShadowTech : FILE {
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects ShadowTech RAT"
		reference = "http://malwareconfig.com/stats/ShadowTech"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "1fb15030-b400-5e70-b183-81e2527d5556"
	strings:
		$a = "ShadowTech" nocase
		$b = "DownloadContainer"
		$c = "MySettings"
		$d = "System.Configuration"
		$newline = "#-@NewLine@-#" wide
		$split = "pSIL" wide
		$key = "ESIL" wide

	condition:
		4 of them
}
YARA Detection Rule: RAT_SmallNet
Repository: Neo23x0/signature-base
Detects: Detects SmallNet RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/SmallNet

Pattern signatures:
$split1 = "!!<3SAFIA<3!!"
		$split2 = "!!ElMattadorDz!!"
		$a1 = "stub_2.Properties"
		$a2 = "stub.exe" wide
		$a3 = "get_CurrentDomain"

Detection condition:
($split1 or $split2) and (all of ($a*))

Full rule:
rule RAT_SmallNet
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects SmallNet RAT"
		reference = "http://malwareconfig.com/stats/SmallNet"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "aec1f8fd-2806-527e-9d50-422f212864de"
	strings:
		$split1 = "!!<3SAFIA<3!!"
		$split2 = "!!ElMattadorDz!!"
		$a1 = "stub_2.Properties"
		$a2 = "stub.exe" wide
		$a3 = "get_CurrentDomain"

	condition:
		($split1 or $split2) and (all of ($a*))
}
YARA Detection Rule: RAT_SpyGate
Repository: Neo23x0/signature-base
Detects: Detects SpyGate RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/SpyGate

Pattern signatures:
$split = "abccba"
		$a1 = "abccbaSpyGateRATabccba" //$a = Version 0.2.6
		$a2 = "StubX.pdb"
		$a3 = "abccbaDanabccb"
		$b1 = "monikerString" nocase //$b = Version 2.0
		$b2 = "virustotal1"
		$b3 = "get_CurrentDomain"
		$c1 = "shutdowncomputer" wide //$c = Version 2.9
		$c2 = "shutdown -r -t 00" wide
		$c3 = "set cdaudio door closed" wide
		$c4 = "FileManagerSplit" wide
		$c5 = "Chating With >> [~Hacker~]" wide

Detection condition:
(all of ($a*) and #split > 40) or (all of ($b*) and #split > 10) or (all of ($c*))

Full rule:
rule RAT_SpyGate
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects SpyGate RAT"
		reference = "http://malwareconfig.com/stats/SpyGate"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "ed015770-81ff-5d9c-8bd0-3c225e400724"
	strings:
		$split = "abccba"
		$a1 = "abccbaSpyGateRATabccba" //$a = Version 0.2.6
		$a2 = "StubX.pdb"
		$a3 = "abccbaDanabccb"
		$b1 = "monikerString" nocase //$b = Version 2.0
		$b2 = "virustotal1"
		$b3 = "get_CurrentDomain"
		$c1 = "shutdowncomputer" wide //$c = Version 2.9
		$c2 = "shutdown -r -t 00" wide
		$c3 = "set cdaudio door closed" wide
		$c4 = "FileManagerSplit" wide
		$c5 = "Chating With >> [~Hacker~]" wide

	condition:
		(all of ($a*) and #split > 40) or (all of ($b*) and #split > 10) or (all of ($c*))
}
YARA Detection Rule: RAT_Sub7Nation
Repository: Neo23x0/signature-base
Detects: Detects Sub7Nation RAT
Author: Kevin Breen <kevin@techanarchy.net> (slightly modified by Florian Roth to improve performance)
Reference: http://malwareconfig.com/stats/Sub7Nation

Pattern signatures:
$a = "EnableLUA /t REG_DWORD /d 0 /f"
		$i = "HostSettings"
		$verSpecific1 = "sevane.tmp"
		$verSpecific2 = "cmd_.bat"
		$verSpecific3 = "a2b7c3d7e4"
		$verSpecific4 = "cmd.dll"

Detection condition:
all of them

Full rule:
rule RAT_Sub7Nation
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net> (slightly modified by Florian Roth to improve performance)"
		date = "01.04.2014"
		description = "Detects Sub7Nation RAT"
		reference = "http://malwareconfig.com/stats/Sub7Nation"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "4f41d649-4a90-566b-bda8-0a288380aeaa"
	strings:
		$a = "EnableLUA /t REG_DWORD /d 0 /f"
		$i = "HostSettings"
		$verSpecific1 = "sevane.tmp"
		$verSpecific2 = "cmd_.bat"
		$verSpecific3 = "a2b7c3d7e4"
		$verSpecific4 = "cmd.dll"

	condition:
		all of them
}
YARA Detection Rule: RAT_Vertex
Repository: Neo23x0/signature-base
Detects: Detects Vertex RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/Vertex

Pattern signatures:
$string1 = "DEFPATH"
		$string2 = "HKNAME"
		$string3 = "HPORT"
		$string4 = "INSTALL"
		$string5 = "IPATH"
		$string6 = "MUTEX"
		$res1 = "PANELPATH"
		$res2 = "ROOTURL"

Detection condition:
all of them

Full rule:
rule RAT_Vertex
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Vertex RAT"
		reference = "http://malwareconfig.com/stats/Vertex"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "f6f5967e-6b88-5d95-8fe1-a286ee8ce64c"
	strings:
		$string1 = "DEFPATH"
		$string2 = "HKNAME"
		$string3 = "HPORT"
		$string4 = "INSTALL"
		$string5 = "IPATH"
		$string6 = "MUTEX"
		$res1 = "PANELPATH"
		$res2 = "ROOTURL"

	condition:
		all of them
}
YARA Detection Rule: RAT_VirusRat
Repository: Neo23x0/signature-base
Detects: Detects VirusRAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/VirusRat

Pattern signatures:
$string0 = "virustotal"
		$string1 = "virusscan"
		$string2 = "abccba"
		$string3 = "pronoip"
		$string4 = "streamWebcam"
		$string5 = "DOMAIN_PASSWORD"
		$string6 = "Stub.Form1.resources"
		$string7 = "ftp://{0}@{1}" wide
		$string8 = "SELECT * FROM moz_logins" wide
		$string9 = "SELECT * FROM moz_disabledHosts" wide
		$string10 = "DynDNS\\Updater\\config.dyndns" wide
		$string11 = "|BawaneH|" wide

Detection condition:
all of them

Full rule:
rule RAT_VirusRat
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects VirusRAT"
		reference = "http://malwareconfig.com/stats/VirusRat"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "ef00cec9-d09b-5010-8e7d-bb391c937f34"
	strings:
		$string0 = "virustotal"
		$string1 = "virusscan"
		$string2 = "abccba"
		$string3 = "pronoip"
		$string4 = "streamWebcam"
		$string5 = "DOMAIN_PASSWORD"
		$string6 = "Stub.Form1.resources"
		$string7 = "ftp://{0}@{1}" wide
		$string8 = "SELECT * FROM moz_logins" wide
		$string9 = "SELECT * FROM moz_disabledHosts" wide
		$string10 = "DynDNS\\Updater\\config.dyndns" wide
		$string11 = "|BawaneH|" wide

	condition:
		all of them
}
YARA Detection Rule: RAT_Xtreme
Repository: Neo23x0/signature-base
Detects: Detects Xtreme RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/Xtreme

Pattern signatures:
$a = "XTREME" wide
		$b = "ServerStarted" wide
		$c = "XtremeKeylogger" wide
		$d = "x.html" wide
		$e = "Xtreme RAT" wide

Detection condition:
all of them

Full rule:
rule RAT_Xtreme
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Xtreme RAT"
		reference = "http://malwareconfig.com/stats/Xtreme"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		ver = "2.9, 3.1, 3.2, 3.5"

		id = "02b7bb6a-5d1e-5379-b[PII_REDACTED]44719"
	strings:
		$a = "XTREME" wide
		$b = "ServerStarted" wide
		$c = "XtremeKeylogger" wide
		$d = "x.html" wide
		$e = "Xtreme RAT" wide

	condition:
		all of them
}
YARA Detection Rule: RAT_adWind
Repository: Neo23x0/signature-base
Detects: Detects Adwind RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/adWind

Pattern signatures:
$meta = "META-INF"
		$conf = "config.xml"
		$a = "Adwind.class"
		$b = "Principal.adwind"

Detection condition:
all of them

Full rule:
rule RAT_adWind
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Adwind RAT"
		reference = "http://malwareconfig.com/stats/adWind"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "95681c07-0e9c-5688-a8a0-899617521c7b"
	strings:
		$meta = "META-INF"
		$conf = "config.xml"
		$a = "Adwind.class"
		$b = "Principal.adwind"

	condition:
		all of them
}
YARA Detection Rule: RAT_njRat
Repository: Neo23x0/signature-base
Detects: Detects njRAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/njRat

Pattern signatures:
$s1 = {7C 00 27 00 7C 00 27 00 7C} // |'|'|
		$s2 = "netsh firewall add allowedprogram" wide
		$s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide
		$s4 = "yyyy-MM-dd" wide

		$v1 = "cmd.exe /k ping 0 & del" wide
		$v2 = "cmd.exe /c ping 127.0.0.1 & del" wide
		$v3 = "cmd.exe /c ping 0 -n 2 & del" wide

Detection condition:
all of ($s*) and any of ($v*)

Full rule:
rule RAT_njRat
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects njRAT"
		reference = "http://malwareconfig.com/stats/njRat"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "6289b9c8-eef6-5cfb-97bd-b819158d6fdd"
	strings:
		$s1 = {7C 00 27 00 7C 00 27 00 7C} // |'|'|
		$s2 = "netsh firewall add allowedprogram" wide
		$s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide
		$s4 = "yyyy-MM-dd" wide

		$v1 = "cmd.exe /k ping 0 & del" wide
		$v2 = "cmd.exe /c ping 127.0.0.1 & del" wide
		$v3 = "cmd.exe /c ping 0 -n 2 & del" wide

	condition:
		all of ($s*) and any of ($v*)
}
YARA Detection Rule: RAT_unrecom
Repository: Neo23x0/signature-base
Detects: Detects unrecom RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/unrecom

Pattern signatures:
$meta = "META-INF"
		$conf = "load/ID"
		$a = "load/JarMain.class"
		$b = "load/MANIFEST.MF"
		$c = "plugins/UnrecomServer.class"

Detection condition:
all of them

Full rule:
rule RAT_unrecom
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects unrecom RAT"
		reference = "http://malwareconfig.com/stats/unrecom"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "56b11c22-f43c-5192-9a0a-0ac14b0cd041"
	strings:
		$meta = "META-INF"
		$conf = "load/ID"
		$a = "load/JarMain.class"
		$b = "load/MANIFEST.MF"
		$c = "plugins/UnrecomServer.class"

	condition:
		all of them
}
YARA Detection Rule: MAL_JRAT_Oct18_1
Repository: Neo23x0/signature-base
Detects: Detects JRAT malware
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "/JRat.class" ascii

Detection condition:
uint16(0) == 0x4b50 and filesize < 700KB and 1 of them

Full rule:
rule MAL_JRAT_Oct18_1 {
   meta:
      description = "Detects JRAT malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2018-10-11"
      hash1 = "ce190c37a6fdb2632f4bc5ea0bb613b3fbe697d04e68e126b41910a6831d3411"
      id = "f211ef1c-8def-55f0-8817-d01ebd9c2947"
   strings:
      $x1 = "/JRat.class" ascii
   condition:
      uint16(0) == 0x4b50 and filesize < 700KB and 1 of them
}
YARA Detection Rule: mal_lockbit4_hashing_alg_win_feb24
Repository: Neo23x0/signature-base
Detects: This rule detects the custom hashing algorithm of Lockbit4.0 unpacked
Author: 0x0d4y
Reference: https://0x0d4y.blog/lockbit4-0-evasion-tales/

Pattern signatures:
$hashing_alg = { 41 89 d0 46 0f be 04 00 45 09 c0 74 ?? 45 8d 48 ?? 45 8d 50 ?? 41 80 f9 ?? 45 0f 43 d0 44 31 d1 44 8d 04 3a 45 0f af c2 41 01 c8 89 d1 31 f9 09 d2 0f 44 ca 41 0f af c8 44 01 d1 ff c2 eb ?? 49 ff c6 }

Detection condition:
uint16(0) == 0x5a4d and
        $hashing_alg

Full rule:
rule mal_lockbit4_hashing_alg_win_feb24
{
    meta:
        author = "0x0d4y"
        description = "This rule detects the custom hashing algorithm of Lockbit4.0 unpacked"
        date = "2024-02-16"
        score = 100
        reference = "https://0x0d4y.blog/lockbit4-0-evasion-tales/"
        hash = "062311F136D83F64497FD81297360CD4"

        uuid = "e91aedba-6f70-4ca2-9217-2991cbbc6e8d"
        license = "CC BY 4.0"
        rule_matching_tlp = "TLP:WHITE"
        rule_sharing_tlp = "TLP:WHITE"
        malpedia_family = "win.lockbit"
    strings:
        $hashing_alg = { 41 89 d0 46 0f be 04 00 45 09 c0 74 ?? 45 8d 48 ?? 45 8d 50 ?? 41 80 f9 ?? 45 0f 43 d0 44 31 d1 44 8d 04 3a 45 0f af c2 41 01 c8 89 d1 31 f9 09 d2 0f 44 ca 41 0f af c8 44 01 d1 ff c2 eb ?? 49 ff c6 }
        
    condition:
        uint16(0) == 0x5a4d and
        $hashing_alg
}
YARA Detection Rule: SUSP_EXPL_CommVault_CVE_2025_57791_Aug25_1
Repository: Neo23x0/signature-base
Detects: Detects potential exploit for WT-2025-0050, authentication bypass through QCommand argument injection
Author: X__Junior
Reference: https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/

Pattern signatures:
$sa1 = "_localadmin__"
      $sa2 = "-localadmin"

Detection condition:
not uint16(0) == 0x5a4d and
      filesize < 20MB and all of them

Full rule:
rule SUSP_EXPL_CommVault_CVE_2025_57791_Aug25_1 {
   meta:
      description = "Detects potential exploit for WT-2025-0050, authentication bypass through QCommand argument injection"
      reference = "https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"
      author = "X__Junior"
      date = "2025-08-21"
      score = 60
   strings:
      $sa1 = "_localadmin__"
      $sa2 = "-localadmin"
   condition:
      not uint16(0) == 0x5a4d and
      filesize < 20MB and all of them
}
YARA Detection Rule: SUSP_EXPL_CommVault_CVE_2025_57791_Aug25_2
Repository: Neo23x0/signature-base
Detects: Detects potential exploit for WT-2025-0050, authentication bypass through QCommand argument injection
Author: X__Junior
Reference: https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/

Pattern signatures:
$sa1 = "_localadmin__"
      $sa2 = "-localadmin" base64

Detection condition:
filesize < 20MB and all of them

Full rule:
rule SUSP_EXPL_CommVault_CVE_2025_57791_Aug25_2 {
   meta:
      description = "Detects potential exploit for WT-2025-0050, authentication bypass through QCommand argument injection"
      reference = "https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"
      author = "X__Junior"
      date = "2025-08-21"
      score = 65
   strings:
      $sa1 = "_localadmin__"
      $sa2 = "-localadmin" base64
   condition:
      filesize < 20MB and all of them
}
YARA Detection Rule: SUSP_EXPL_CommVault_CVE_2025_57791_Artifact_Aug25
Repository: Neo23x0/signature-base
Detects: Detects exploit artifact for WT-2025-0050, authentication bypass through QCommand argument injection
Author: X__Junior
Reference: https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/

Pattern signatures:
$sa1 = "_localadmin__"
      $sa2 = /-cs [a-zA-Z0-9-{}]{3,32} -cs /

      $sb2 = "-localadmin" base64
      $sb1 = "-localadmin"

Detection condition:
filesize < 20MB and all of ($sa*) and 1 of ($sb*)

Full rule:
rule SUSP_EXPL_CommVault_CVE_2025_57791_Artifact_Aug25 {
   meta:
      description = "Detects exploit artifact for WT-2025-0050, authentication bypass through QCommand argument injection"
      reference = "https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"
      author = "X__Junior"
      date = "2025-08-21"
      score = 75
   strings:
      $sa1 = "_localadmin__"
      $sa2 = /-cs [a-zA-Z0-9-{}]{3,32} -cs /

      $sb2 = "-localadmin" base64
      $sb1 = "-localadmin"
   condition:
      filesize < 20MB and all of ($sa*) and 1 of ($sb*)
}
YARA Detection Rule: EXPL_JSP_CommVault_CVE_2025_57791_Aug25_1
Repository: Neo23x0/signature-base
Detects: Detects potential exploit for WT-2025-0049, Post-Auth RCE with QCommand Path Traversal
Author: X__Junior
Reference: https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/

Pattern signatures:
$s1 = "<App_GetUserPropertiesResponse>" ascii
      $s2 = "getMethod('getRuntime').invoke(null).exec(param.cmd)" ascii

Detection condition:
filesize < 50KB and all of them

Full rule:
rule EXPL_JSP_CommVault_CVE_2025_57791_Aug25_1 {
   meta:
      description = "Detects potential exploit for WT-2025-0049, Post-Auth RCE with QCommand Path Traversal"
      author = "X__Junior"
      date = "2025-08-21"
      reference = "https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"
      score = 75
   strings:
      $s1 = "<App_GetUserPropertiesResponse>" ascii
      $s2 = "getMethod('getRuntime').invoke(null).exec(param.cmd)" ascii
   condition:
      filesize < 50KB and all of them
}
YARA Detection Rule: EXPL_JSP_CommVault_CVE_2025_57791_Aug25_2
Repository: Neo23x0/signature-base
Detects: Detects potential exploit for WT-2025-0049, Post-Auth RCE with QCommand Path Traversal
Author: X__Junior
Reference: https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/

Pattern signatures:
$s1 = "<App_UpdateUserPropertiesRequest>" ascii
      $s2 = "<description>" ascii
      $s3 = "getMethod('getRuntime').invoke(null).exec(param.cmd)" ascii

Detection condition:
filesize < 50KB and all of them

Full rule:
rule EXPL_JSP_CommVault_CVE_2025_57791_Aug25_2 {
   meta:
      description = "Detects potential exploit for WT-2025-0049, Post-Auth RCE with QCommand Path Traversal"
      author = "X__Junior"
      date = "2025-08-21"
      reference = "https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"
      score = 75
   strings:
      $s1 = "<App_UpdateUserPropertiesRequest>" ascii
      $s2 = "<description>" ascii
      $s3 = "getMethod('getRuntime').invoke(null).exec(param.cmd)" ascii
   condition:
      filesize < 50KB and all of them
}
YARA Detection Rule: EXPL_LOG_CommVault_CVE_2025_57791_Indicator_Shell_Drop_Aug25
Repository: Neo23x0/signature-base
Detects: Detects suspicious log lines that indicate web shell drops into the Apache root folder of a Commvault installation
Author: Florian Roth
Reference: https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/

Pattern signatures:
$xr1 = /Results written to \[[C-Z]:\\Program Files\\Commvault\\ContentStore\\Apache\\webapps\\ROOT\\[^\\]{1,20}\.jsp\]/  // https://regex101.com/r/KV8iK6/1

Detection condition:
$xr1

Full rule:
rule EXPL_LOG_CommVault_CVE_2025_57791_Indicator_Shell_Drop_Aug25 {
   meta:
      description = "Detects suspicious log lines that indicate web shell drops into the Apache root folder of a Commvault installation"
      author = "Florian Roth"
      reference = "https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"
      date = "2025-08-21"
      score = 70
   strings:
      $xr1 = /Results written to \[[C-Z]:\\Program Files\\Commvault\\ContentStore\\Apache\\webapps\\ROOT\\[^\\]{1,20}\.jsp\]/  // https://regex101.com/r/KV8iK6/1
   condition:
      $xr1
}
YARA Detection Rule: MAL_Backdoor_SPAREPART_SleepGenerator
Repository: Neo23x0/signature-base
Detects: Detects the algorithm used to determine the next sleep timer
Author: Mandiant
Reference: https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government

Pattern signatures:
$ = {C1 E8 06 89 [5] C1 E8 02 8B}
        $ = {c1 e9 03 33 c1 [3] c1 e9 05 33 c1 83 e0 01}
        $ = {8B 80 FC 00 00 00}
        $ = {D1 E8 [4] c1 E1 0f 0b c1}

Detection condition:
all of them

Full rule:
rule MAL_Backdoor_SPAREPART_SleepGenerator {
    meta:
        author = "Mandiant"
        date = "2022-12-14"
        description = "Detects the algorithm used to determine the next sleep timer"
        version = "1"
        weight = "100"
        hash = "f9cd5b145e372553dded92628db038d8"
        disclaimer = "This rule is meant for hunting and is not tested to run in a production environment."
        reference = "https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government"
        id = "b9cd46e4-0e06-5ead-8379-adcfc3c384d0"
    strings:
        $ = {C1 E8 06 89 [5] C1 E8 02 8B}
        $ = {c1 e9 03 33 c1 [3] c1 e9 05 33 c1 83 e0 01}
        $ = {8B 80 FC 00 00 00}
        $ = {D1 E8 [4] c1 E1 0f 0b c1}
    condition:
        all of them
}
YARA Detection Rule: MAL_Backdoor_SPAREPART_Struct
Repository: Neo23x0/signature-base
Detects: Detects the PDB and a struct used in SPAREPART
Author: Mandiant
Reference: https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government

Pattern signatures:
$pdb = "c:\\Users\\user\\Desktop\\ImageAgent\\ImageAgent\\PreAgent\\src\\builder\\agent.pdb" ascii nocase
        $struct = { 44 89 ac ?? ?? ?? ?? ?? 4? 8b ac ?? ?? ?? ?? ?? 4? 83 c5 28 89 84 ?? ?? ?? ?? ?? 89 8c ?? ?? ?? ?? ?? 89 54 ?? ?? 44 89 44 ?? ?? 44 89 4c ?? ?? 44 89 54 ?? ?? 44 89 5c ?? ?? 89 5c ?? ?? 89 7c ?? ?? 89 74 ?? ?? 89 6c ?? ?? 44 89 74 ?? ?? 44 89 7c ?? ?? 44 89 64 ?? ?? 8b 84 ?? ?? ?? ?? ?? 44 8b c8 8b 84 ?? ?? ?? ?? ?? 44 8b c0 4? 8d 15 ?? ?? ?? ?? 4? 8b cd ff 15 ?? ?? ?? ??  }

Detection condition:
(uint16(0) == 0x5A4D) and uint32(uint32(0x3C)) == 0x00004550 and
       $pdb and
       $struct and
       filesize < 20KB

Full rule:
rule MAL_Backdoor_SPAREPART_Struct {
    meta:
        author = "Mandiant"
        date = "2022-12-14"
        description = "Detects the PDB and a struct used in SPAREPART"
        hash = "f9cd5b145e372553dded92628db038d8"
        disclaimer = "This rule is meant for hunting and is not tested to run in a production environment."
        reference = "https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government"
        id = "a04296d5-c146-5142-a8e8-418651f6b755"
    strings:
        $pdb = "c:\\Users\\user\\Desktop\\ImageAgent\\ImageAgent\\PreAgent\\src\\builder\\agent.pdb" ascii nocase
        $struct = { 44 89 ac ?? ?? ?? ?? ?? 4? 8b ac ?? ?? ?? ?? ?? 4? 83 c5 28 89 84 ?? ?? ?? ?? ?? 89 8c ?? ?? ?? ?? ?? 89 54 ?? ?? 44 89 44 ?? ?? 44 89 4c ?? ?? 44 89 54 ?? ?? 44 89 5c ?? ?? 89 5c ?? ?? 89 7c ?? ?? 89 74 ?? ?? 89 6c ?? ?? 44 89 74 ?? ?? 44 89 7c ?? ?? 44 89 64 ?? ?? 8b 84 ?? ?? ?? ?? ?? 44 8b c8 8b 84 ?? ?? ?? ?? ?? 44 8b c0 4? 8d 15 ?? ?? ?? ?? 4? 8b cd ff 15 ?? ?? ?? ??  }
    condition:
       (uint16(0) == 0x5A4D) and uint32(uint32(0x3C)) == 0x00004550 and
       $pdb and
       $struct and
       filesize < 20KB
}