deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: PowerShell_Suite_Eidolon
Repository: Neo23x0/signature-base
Detects: Detects PowerShell Suite Eidolon script - file Start-Eidolon.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/FuzzySecurity/PowerShell-Suite

Pattern signatures:
$ = "[+] Eidolon entry point:" ascii
      $ = "C:\\PS> Start-Eidolon -Target C:\\Some\\File.Path -Mimikatz -Verbose" fullword ascii
      $ = "[Int16]$PEArch = '0x{0}' -f ((($PayloadBytes[($OptOffset+1)..($OptOffset)]) | % {$_.ToString('X2')}) -join '')" fullword ascii

Detection condition:
uint16(0) == 0x7566 and filesize < 13000KB and 1 of them

Full rule:
rule PowerShell_Suite_Eidolon {
   meta:
      description = "Detects PowerShell Suite Eidolon script - file Start-Eidolon.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/FuzzySecurity/PowerShell-Suite"
      date = "2017-12-27"
      hash1 = "db31367410d0a9ffc9ed37f423a4b082639591be7f46aca91f5be261b23212d5"
      id = "5440d8fc-b939-556f-a8a0-ef5feb29e32f"
   strings:
      $ = "[+] Eidolon entry point:" ascii
      $ = "C:\\PS> Start-Eidolon -Target C:\\Some\\File.Path -Mimikatz -Verbose" fullword ascii
      $ = "[Int16]$PEArch = '0x{0}' -f ((($PayloadBytes[($OptOffset+1)..($OptOffset)]) | % {$_.ToString('X2')}) -join '')" fullword ascii
   condition:
      uint16(0) == 0x7566 and filesize < 13000KB and 1 of them
}
YARA Detection Rule: XMRIG_Monero_Miner
Repository: Neo23x0/signature-base
Detects: Detects Monero mining software
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/xmrig/xmrig/releases

Pattern signatures:
$s1 = "'h' hashrate, 'p' pause, 'r' resume" fullword ascii
      $s2 = "--cpu-affinity" ascii
      $s3 = "set process affinity to CPU core(s), mask 0x3 for cores 0 and 1" ascii
      $s4 = "password for mining server" fullword ascii
      $s5 = "XMRig/%s libuv/%s%s" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d or uint16(0) == 0x457f ) and filesize < 10MB and 2 of them

Full rule:
rule XMRIG_Monero_Miner : HIGHVOL {
   meta:
      description = "Detects Monero mining software"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/xmrig/xmrig/releases"
      date = "2018-01-04"
      modified = "2022-11-10"
      modified = "2022-11-10"
      hash1 = "5c13a274adb[PII_REDACTED]495446bb6be5f2a08f9dcd2fc8a2049d9dc471135c0"
      hash2 = "08b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7"
      hash3 = "f3f2703a7959183b010d808521b531559650f6f347a5830e47f8e3831b10bad5"
      hash4 = "0972ea3a41655968f063c91a6dbd31788b20e64ff272b27961d12c681e40b2d2"
      id = "71bf1b9c-c806-5737-83a9-d6013872b11d"
   strings:
      $s1 = "'h' hashrate, 'p' pause, 'r' resume" fullword ascii
      $s2 = "--cpu-affinity" ascii
      $s3 = "set process affinity to CPU core(s), mask 0x3 for cores 0 and 1" ascii
      $s4 = "password for mining server" fullword ascii
      $s5 = "XMRig/%s libuv/%s%s" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d or uint16(0) == 0x457f ) and filesize < 10MB and 2 of them
}
YARA Detection Rule: XMRIG_Monero_Miner_Config
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - from files config.json, config.json
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/xmrig/xmrig/releases

Pattern signatures:
$s2 = "\"cpu-affinity\": null,   // set process affinity to CPU core(s), mask \"0x3\" for cores 0 and 1" fullword ascii
      $s5 = "\"nicehash\": false                  // enable nicehash/xmrig-proxy support" fullword ascii
      $s8 = "\"algo\": \"cryptonight\",  // cryptonight (default) or cryptonight-lite" fullword ascii

Detection condition:
( uint16(0) == 0x0a7b or uint16(0) == 0x0d7b ) and filesize < 5KB and 1 of them

Full rule:
rule XMRIG_Monero_Miner_Config {
   meta:
      description = "Auto-generated rule - from files config.json, config.json"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/xmrig/xmrig/releases"
      date = "2018-01-04"
      hash1 = "031333d44a3a917f9654d7e7257e00c9d961ada3bee707de94b7c7d06234909a"
      hash2 = "409b6ec82c3bdac724dae702e20cb7f80ca1e79efa4ff[PII_REDACTED]5af016c41"
      id = "374efe7f-9ef2-5974-8e24-f749183ab2d0"
   strings:
      $s2 = "\"cpu-affinity\": null,   // set process affinity to CPU core(s), mask \"0x3\" for cores 0 and 1" fullword ascii
      $s5 = "\"nicehash\": false                  // enable nicehash/xmrig-proxy support" fullword ascii
      $s8 = "\"algo\": \"cryptonight\",  // cryptonight (default) or cryptonight-lite" fullword ascii
   condition:
      ( uint16(0) == 0x0a7b or uint16(0) == 0x0d7b ) and filesize < 5KB and 1 of them
}
YARA Detection Rule: PUA_LNX_XMRIG_CryptoMiner
Repository: Neo23x0/signature-base
Detects: Detects XMRIG CryptoMiner software
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "number of hash blocks to process at a time (don't set or 0 enables automatic selection o" fullword ascii
      $s2 = "'h' hashrate, 'p' pause, 'r' resume, 'q' shutdown" fullword ascii
      $s3 = "* THREADS:      %d, %s, aes=%d, hf=%zu, %sdonate=%d%%" fullword ascii
      $s4 = ".nicehash.com" ascii

Detection condition:
uint16(0) == 0x457f and filesize < 8000KB and ( 1 of ($x*) or 2 of them )

Full rule:
rule PUA_LNX_XMRIG_CryptoMiner {
   meta:
      description = "Detects XMRIG CryptoMiner software"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2018-06-28"
      modified = "2023-01-06"
      hash1 = "10a72f9882fc0ca141e39277222a8d33aab7f7a4b524c109506a407cd10d738c"
      id = "bbdeff2e-68cc-5bbe-b843-3cba9c8c7ea8"
   strings:
      $x1 = "number of hash blocks to process at a time (don't set or 0 enables automatic selection o" fullword ascii
      $s2 = "'h' hashrate, 'p' pause, 'r' resume, 'q' shutdown" fullword ascii
      $s3 = "* THREADS:      %d, %s, aes=%d, hf=%zu, %sdonate=%d%%" fullword ascii
      $s4 = ".nicehash.com" ascii
   condition:
      uint16(0) == 0x457f and filesize < 8000KB and ( 1 of ($x*) or 2 of them )
}
YARA Detection Rule: SUSP_XMRIG_String
Repository: Neo23x0/signature-base
Detects: Detects a suspicious XMRIG crypto miner executable string in filr
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "xmrig.exe" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them

Full rule:
rule SUSP_XMRIG_String {
   meta:
      description = "Detects a suspicious XMRIG crypto miner executable string in filr"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2018-12-28"
      hash1 = "eb18ae69f1511eeb4ed9d4d7bcdf3391a06768f384e94427f4fc3bd21b383127"
      id = "8c6f3e6e-df2a-51b7-81b8-21cd33b3c603"
   strings:
      $x1 = "xmrig.exe" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them
}
YARA Detection Rule: WinAgent_BadPatch_1
Repository: Neo23x0/signature-base
Detects: Detects samples mentioned in BadPatch report
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/RvDwwA

Pattern signatures:
$x1 = "J:\\newPatch\\downloader\\" wide
      $x2 = "L:\\rashed\\New code\\" wide
      $x3 = ":\\newPatch\\last version\\" wide
      $x4 = "\\Microsoft\\Microsoft\\Microsoft1.log" wide
      $x5 = "\\Microsoft\\Microsoft\\Microsoft.log" wide
      $x6 = "\\Microsoft\\newPP.exe" wide
      $x7 = " (this is probably a proxy server error)." fullword wide
      $x8 = " :Old - update patch and check anti-virus.. " fullword wide
      $x9 = "PatchNotExit-- download now.. " fullword wide
      $x10 = "PatchNotExit-- Check Version" fullword wide
      $x11 = "PatchNotExit-- Version Patch" fullword wide

      $s1 = "downloader " fullword wide
      $s2 = "DelDownloadFile" fullword ascii
      $s3 = "downloadFile" fullword ascii
      $s4 = "downloadUpdate" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 600KB and ( 1 of ($x*) or 4 of them ) )

Full rule:
rule WinAgent_BadPatch_1 {
   meta:
      description = "Detects samples mentioned in BadPatch report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/RvDwwA"
      date = "2017-10-20"
      hash1 = "285998bce9692e[PII_REDACTED]5775aa05e3a5cb93ee4e65d021d2231256e92813"
      id = "732792ed-cb70-5b69-8457-f54177e4609e"
   strings:
      $x1 = "J:\\newPatch\\downloader\\" wide
      $x2 = "L:\\rashed\\New code\\" wide
      $x3 = ":\\newPatch\\last version\\" wide
      $x4 = "\\Microsoft\\Microsoft\\Microsoft1.log" wide
      $x5 = "\\Microsoft\\Microsoft\\Microsoft.log" wide
      $x6 = "\\Microsoft\\newPP.exe" wide
      $x7 = " (this is probably a proxy server error)." fullword wide
      $x8 = " :Old - update patch and check anti-virus.. " fullword wide
      $x9 = "PatchNotExit-- download now.. " fullword wide
      $x10 = "PatchNotExit-- Check Version" fullword wide
      $x11 = "PatchNotExit-- Version Patch" fullword wide

      $s1 = "downloader " fullword wide
      $s2 = "DelDownloadFile" fullword ascii
      $s3 = "downloadFile" fullword ascii
      $s4 = "downloadUpdate" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 600KB and ( 1 of ($x*) or 4 of them ) )
}
YARA Detection Rule: WinAgent_BadPatch_2
Repository: Neo23x0/signature-base
Detects: Detects samples mentioned in BadPatch report
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/RvDwwA

Pattern signatures:
$s1 = "myAction=shell_result&serialNumber=" fullword wide
      $s2 = "\\Appdata\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.*" wide
      $s3 = "\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" wide
      $s4 = "\\Appdata\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.*" wide
      $s5 = "newSHELL[" fullword wide
      $s6 = "\\file1.txt" wide
      $s7 = "myAction=newGIF&serialNumber=" fullword wide
      $s8 = "\\Storege1" wide
      $s9 = "\\Microsoft\\mac.txt" wide
      $s10 = "spytube____:" fullword ascii
      $s11 = "0D0700045F5C5B0312045A04041F40014B1D11004A1F19074A[PII_REDACTED]0154B031C04" fullword wide
      $s12 = "16161A1000012B[PII_REDACTED]1065A1A0007" fullword wide
      $s13 = "-- SysFile...." fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 700KB and 3 of them )

Full rule:
rule WinAgent_BadPatch_2 {
   meta:
      description = "Detects samples mentioned in BadPatch report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/RvDwwA"
      date = "2017-10-20"
      hash1 = "106deff16a93c4a4624fe96e3274e1432921c56d5a430834775e5b98861c00ea"
      hash2 = "ece76fdf7e33d05a757ef5ed020140d9367c7319022a889923bbfacccb58f4d7"
      hash3 = "cf53fc8c9ce4e5797cc5ac6f71d4cbc0f2b15f2ed43f38048a5273f40bc09876"
      hash4 = "802a39b22dfacdc2325f8a839377c903b4a[PII_REDACTED]ce6f7aed67e824b82c2"
      hash5 = "278dba[PII_REDACTED]fc2d693b7d96cef4f06cb7fdc52260b1c804b9c90d43646d"
      hash6 = "2941f75da0574c21e4772f015ef38bb623dd4d0c81c263523d431b0114dd847e"
      hash7 = "46f3afae22e83344e4311482a9987ed851b2de282e8127f64d5901ac945713c0"
      hash8 = "27752bbb01abc6abf50e1da3a59fefcce[PII_REDACTED]9d68690e71ad9d4a3c247"
      hash9 = "050610cfb3d[PII_REDACTED]826273546c829335a5f4e2e4260461b88367ad9502c"
      id = "648528f0-351c-527e-b516-2c8cae9fb4a3"
   strings:
      $s1 = "myAction=shell_result&serialNumber=" fullword wide
      $s2 = "\\Appdata\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.*" wide
      $s3 = "\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" wide
      $s4 = "\\Appdata\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.*" wide
      $s5 = "newSHELL[" fullword wide
      $s6 = "\\file1.txt" wide
      $s7 = "myAction=newGIF&serialNumber=" fullword wide
      $s8 = "\\Storege1" wide
      $s9 = "\\Microsoft\\mac.txt" wide
      $s10 = "spytube____:" fullword ascii
      $s11 = "0D0700045F5C5B0312045A04041F40014B1D11004A1F19074A[PII_REDACTED]0154B031C04" fullword wide
      $s12 = "16161A1000012B[PII_REDACTED]1065A1A0007" fullword wide
      $s13 = "-- SysFile...." fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 700KB and 3 of them )
}
YARA Detection Rule: APT_MAL_WinntiLinux_Dropper_AzazelFork_May19
Repository: Neo23x0/signature-base
Detects: Detection of Linux variant of Winnti
Author: Silas Cutler (havex [@] chronicle.security), Chronicle Security

Pattern signatures:
$config_decr = { 48 89 45 F0 C7 45 EC 08 01 00 00 C7 45 FC 28 00 00 00 EB 31 8B 45 FC 48 63 D0 48 8B 45 F0 48 01 C2 8B 45 FC 48 63 C8 48 8B 45 F0 48 01 C8 0F B6 00 89 C1 8B 45 F8 89 C6 8B 45 FC 01 F0 31 C8 88 02 83 45 FC 01 }
        $export1 = "our_sockets"
        $export2 = "get_our_pids"

Detection condition:
uint16(0) == 0x457f and all of them

Full rule:
rule APT_MAL_WinntiLinux_Dropper_AzazelFork_May19 : azazel_fork {
    meta:
        description = "Detection of Linux variant of Winnti"
        author = "Silas Cutler (havex [@] chronicle.security), Chronicle Security"
        version = "1.0"
        date = "2019-05-15"
        TLP = "White"
        sha256 = "4741c2884d1ca3a40dadd3f3f61cb95a59b11f99a0f980dbadc663b85eb77a2a"
        id = "d641de9a-e563-5067-b7e4-0aa83a087ed4"
    strings:
        $config_decr = { 48 89 45 F0 C7 45 EC 08 01 00 00 C7 45 FC 28 00 00 00 EB 31 8B 45 FC 48 63 D0 48 8B 45 F0 48 01 C2 8B 45 FC 48 63 C8 48 8B 45 F0 48 01 C8 0F B6 00 89 C1 8B 45 F8 89 C6 8B 45 FC 01 F0 31 C8 88 02 83 45 FC 01 }
        $export1 = "our_sockets"
        $export2 = "get_our_pids"
    condition:
        uint16(0) == 0x457f and all of them
}
YARA Detection Rule: APT_MAL_WinntiLinux_Main_AzazelFork_May19
Repository: Neo23x0/signature-base
Detects: Detection of Linux variant of Winnti
Author: Silas Cutler (havex [@] chronicle.security), Chronicle Security

Pattern signatures:
$uuid_lookup = "/usr/sbin/dmidecode  | grep -i 'UUID' |cut -d' ' -f2 2>/dev/null"
        $dbg_msg = "[advNetSrv] can not create a PF_INET socket"
        $rtti_name1 = "CNetBase"
        $rtti_name2 = "CMyEngineNetEvent"
        $rtti_name3 = "CBufferCache"
        $rtti_name4 = "CSocks5Base"
        $rtti_name5 = "CDataEngine"
        $rtti_name6 = "CSocks5Mgr"
        $rtti_name7 = "CRemoteMsg"

Detection condition:
uint16(0) == 0x457f and ( ($dbg_msg and 1 of ($rtti*)) or (5 of ($rtti*)) or ($uuid_lookup and 2 of ($rtti*)) )

Full rule:
rule APT_MAL_WinntiLinux_Main_AzazelFork_May19 {
    meta:
        description = "Detection of Linux variant of Winnti"
        author = "Silas Cutler (havex [@] chronicle.security), Chronicle Security"
        version = "1.0"
        date = "2019-05-15"
        TLP = "White"
        sha256 = "ae9d6848f33644795a0cc3928a76ea194b99da3c10f802db22034d9f695a0c23"
        id = "a1693e2d-4d89-5cc7-ab14-c8feb000638a"
    strings:
        $uuid_lookup = "/usr/sbin/dmidecode  | grep -i 'UUID' |cut -d' ' -f2 2>/dev/null"
        $dbg_msg = "[advNetSrv] can not create a PF_INET socket"
        $rtti_name1 = "CNetBase"
        $rtti_name2 = "CMyEngineNetEvent"
        $rtti_name3 = "CBufferCache"
        $rtti_name4 = "CSocks5Base"
        $rtti_name5 = "CDataEngine"
        $rtti_name6 = "CSocks5Mgr"
        $rtti_name7 = "CRemoteMsg"
    condition:
        uint16(0) == 0x457f and ( ($dbg_msg and 1 of ($rtti*)) or (5 of ($rtti*)) or ($uuid_lookup and 2 of ($rtti*)) )
}
YARA Detection Rule: MAL_UNC2891_Caketap
Repository: Neo23x0/signature-base
Detects: Detects UNC2891 Rootkit Caketap
Author: Frank Boldewin (@r3c0nst)
Reference: https://github.com/fboldewin/YARA-rules/tree/master

Pattern signatures:
$str1  = ".caahGss187" ascii fullword // SyS_mkdir hook cmd ident
      $str2 = "ipstat" ascii // rootkit lkm name
      $code1 = {41 80 7E 06 4B 75 ?? 41 80 7E 07 57 75 ?? 41 0F B6 46 2B} // HSM cmd KW check
      $code2 = {41 C6 46 01 3D 41 C6 46 08 32} // mode_flag switch

Detection condition:
uint32 (0) ==  0x464c457f and (all of ($code*) or (all of ($str*) and #str2 == 2))

Full rule:
rule MAL_UNC2891_Caketap {
   meta:
      description = "Detects UNC2891 Rootkit Caketap"
      author = "Frank Boldewin (@r3c0nst)"
      date = "2022-03-30"
      reference = "https://github.com/fboldewin/YARA-rules/tree/master"

      id = "9c2ffe3d-69ca-5f93-bdb1-40e449139dec"
   strings:
      $str1  = ".caahGss187" ascii fullword // SyS_mkdir hook cmd ident
      $str2 = "ipstat" ascii // rootkit lkm name
      $code1 = {41 80 7E 06 4B 75 ?? 41 80 7E 07 57 75 ?? 41 0F B6 46 2B} // HSM cmd KW check
      $code2 = {41 C6 46 01 3D 41 C6 46 08 32} // mode_flag switch
   condition:
      uint32 (0) ==  0x464c457f and (all of ($code*) or (all of ($str*) and #str2 == 2))
}
YARA Detection Rule: MAL_UNC2891_Slapstick
Repository: Neo23x0/signature-base
Detects: Detects UNC2891 Slapstick pam backdoor
Author: Frank Boldewin (@r3c0nst), slightly modifier by Florian Roth
Reference: https://github.com/fboldewin/YARA-rules/tree/master

Pattern signatures:
$code1 = {F6 50 04 48 FF C0 48 39 D0 75 F5} // string decrypter
      $code2 = {88 01 48 FF C1 8A 11 89 C8 29 F8 84 D2 0F 85} // log buf crypter
      $str1 = "/proc/self/exe" fullword ascii
      $str2 = "%-23s %-23s %-23s %-23s %-23s %s" fullword ascii
      $str3 = "pam_sm_authenticate" ascii
      /* $str4 = "ACCESS GRANTED & WELCOME" xor // pam prompt message */
      $str_fr1 = "HISTFILE=/dev/null" // replacement for XORED message for memory usage reasons

Detection condition:
uint32 (0) ==  0x464c457f and filesize < 100KB and (all of ($code*) or all of ($str*))

Full rule:
rule MAL_UNC2891_Slapstick {
   meta:
      description = "Detects UNC2891 Slapstick pam backdoor"
      author = "Frank Boldewin (@r3c0nst), slightly modifier by Florian Roth"
      date = "2022-03-30"
      modified = "2023-01-05"
      reference = "https://github.com/fboldewin/YARA-rules/tree/master"
      hash1 = "9d0165e0484c31bd4ea467650b2ae2f359f67ae1016af49326bb374cead5f789"

      id = "eb5db507-ac12-5c11-9dd9-ec34b9a80e1c"
   strings:
      $code1 = {F6 50 04 48 FF C0 48 39 D0 75 F5} // string decrypter
      $code2 = {88 01 48 FF C1 8A 11 89 C8 29 F8 84 D2 0F 85} // log buf crypter
      $str1 = "/proc/self/exe" fullword ascii
      $str2 = "%-23s %-23s %-23s %-23s %-23s %s" fullword ascii
      $str3 = "pam_sm_authenticate" ascii
      /* $str4 = "ACCESS GRANTED & WELCOME" xor // pam prompt message */
      $str_fr1 = "HISTFILE=/dev/null" // replacement for XORED message for memory usage reasons
   condition:
      uint32 (0) ==  0x464c457f and filesize < 100KB and (all of ($code*) or all of ($str*))
}
YARA Detection Rule: MAL_UNC2891_Steelcorgi
Repository: Neo23x0/signature-base
Detects: Detects UNC2891 Steelcorgi packed ELF binaries
Author: Frank Boldewin (@r3c0nst)
Reference: https://github.com/fboldewin/YARA-rules/tree/master

Pattern signatures:
$pattern1 = {70 61 64 00 6C 63 6B 00} // padlck
      $pattern2 = {FF 72 FF 6F FF 63 FF 2F FF 73 FF 65 FF 6C FF 66 FF 2F FF 65 FF 78 FF 65} // proc_self_exe

Detection condition:
uint32(0) == 0x464c457f and all of them

Full rule:
rule MAL_UNC2891_Steelcorgi {
   meta:
      description = "Detects UNC2891 Steelcorgi packed ELF binaries"
      author = "Frank Boldewin (@r3c0nst)"
      date = "2022-03-30"
      reference = "https://github.com/fboldewin/YARA-rules/tree/master"
      hash1 = "0760cd30d18517e87bf9fd[PII_REDACTED]db1cd80730b47f57167219ddbf91f170"
      hash2 = "3560ed07aac67f73ef910d0b928db3c0bb5f106b5daee054666638b6575a89c5"
      hash3 = "5b4bb50055b31dbd897172583c7046dd27cd03e1e3d84f7a23837e8df7943547"
      
      id = "94da7da5-5fc3-5221-97d6-1854aa7b1959"
   strings:
      $pattern1 = {70 61 64 00 6C 63 6B 00} // padlck
      $pattern2 = {FF 72 FF 6F FF 63 FF 2F FF 73 FF 65 FF 6C FF 66 FF 2F FF 65 FF 78 FF 65} // proc_self_exe
      
   condition:
      uint32(0) == 0x464c457f and all of them
}
YARA Detection Rule: MAL_UNC2891_Winghook
Repository: Neo23x0/signature-base
Detects: Detects UNC2891 Winghook Keylogger
Author: Frank Boldewin (@r3c0nst)
Reference: https://github.com/fboldewin/YARA-rules/tree/master

Pattern signatures:
$code1 = {01 F9 81 E1 FF 00 00 00 41 89 CA [15] 44 01 CF 81 E7 FF 00 00 00} // crypt log file data
      $code2 = {83 E2 0F 0F B6 14 1? 32 14 01 88 14 0? 48 83 ?? ?? 48 83 ?? ?? 75} // decrypt path+logfile name
      $str1 = "fgets" ascii // hook function name
      $str2 = "read" ascii // hook function name

Detection condition:
uint32 (0) ==  0x464c457f and filesize < 100KB and 1 of ($code*) and all of ($str*)

Full rule:
rule MAL_UNC2891_Winghook {
   meta:
      description = "Detects UNC2891 Winghook Keylogger"
      author = "Frank Boldewin (@r3c0nst)"
      date = "2022-03-30"
      reference = "https://github.com/fboldewin/YARA-rules/tree/master"
      hash1 = "d071ee723982cf53e4bce89f3de5a8ef1853457b21bffdae387c4c2bd160a38e"

      id = "e5955fa0-8204-58e3-88a6-de4b47756ede"
   strings:
      $code1 = {01 F9 81 E1 FF 00 00 00 41 89 CA [15] 44 01 CF 81 E7 FF 00 00 00} // crypt log file data
      $code2 = {83 E2 0F 0F B6 14 1? 32 14 01 88 14 0? 48 83 ?? ?? 48 83 ?? ?? 75} // decrypt path+logfile name
      $str1 = "fgets" ascii // hook function name
      $str2 = "read" ascii // hook function name
   condition:
      uint32 (0) ==  0x464c457f and filesize < 100KB and 1 of ($code*) and all of ($str*)
}
YARA Detection Rule: DarkEYEv3_Cryptor
Repository: Neo23x0/signature-base
Detects: Rule to detect DarkEYEv3 encrypted executables (often malware)
Author: Florian Roth (Nextron Systems)
Reference: http://darkeyev3.blogspot.fi/

Pattern signatures:
$s0 = "\\DarkEYEV3-"

Detection condition:
uint16(0) == 0x5a4d and $s0

Full rule:
rule DarkEYEv3_Cryptor {
	meta:
		description = "Rule to detect DarkEYEv3 encrypted executables (often malware)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://darkeyev3.blogspot.fi/"
		date = "2015-05-24"
		hash0 = "6b854b967397f7de0da2326bdd5d39e710e2bb12"
		hash1 = "d53149968eca654fc0e803f925e7526fdac2786c"
		hash2 = "7e3a8940d446c57504d6a7edb6445681cca31c65"
		hash3 = "d3dd665dd77b02d7024ac16eb0949f4f598299e7"
		hash4 = "a907a7b74a096f024efe57953c85464e87275ba3"
		hash5 = "b1c422155f76f992048377ee50c79fe164b22293"
		hash6 = "29f5322ce5e9147f09e0a86cc23a7c8dc88721b9"
		hash7 = "a0382d7c12895489cb37efef74c5f666ea750b05"
		hash8 = "f3d5b71b7aeeb6cc917d5bb67e2165cf8a2fbe61"
		score = 55
		id = "a2b455e5-3021-5662-b593-c1aeeb34c226"
	strings:
		$s0 = "\\DarkEYEV3-" 
	condition:
		uint16(0) == 0x5a4d and $s0
}
YARA Detection Rule: Ysoserial_Payload_MozillaRhino1
Repository: Neo23x0/signature-base
Detects: Ysoserial Payloads - file MozillaRhino1.bin
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/frohoff/ysoserial

Pattern signatures:
$s3 = "ysoserial.payloads" fullword ascii

Detection condition:
( uint16(0) == 0xedac and filesize < 40KB and all of them )

Full rule:
rule Ysoserial_Payload_MozillaRhino1 {
   meta:
      description = "Ysoserial Payloads - file MozillaRhino1.bin"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/frohoff/ysoserial"
      date = "2017-02-04"
      hash1 = "0143fee12fea5118be6dcbb862d8ba639790b7505eac00a9f1028481f874baa8"
      id = "c269e032-b6ce-5faa-b3ce-a5304f3e9dab"
   strings:
      $s3 = "ysoserial.payloads" fullword ascii
   condition:
      ( uint16(0) == 0xedac and filesize < 40KB and all of them )
}