deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Mirai_Botnet_Malware
Repository: Neo23x0/signature-base
Detects: Detects Mirai Botnet Malware
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "POST /cdn-cgi/" ascii
		$x2 = "/dev/misc/watchdog" fullword ascii
		$x3 = "/dev/watchdog" ascii
		$x5 = ".mdebug.abi32" fullword ascii

		$s1 = "LCOGQGPTGP" fullword ascii
		$s2 = "QUKLEKLUKVJOG" fullword ascii
		$s3 = "CFOKLKQVPCVMP" fullword ascii
		$s4 = "QWRGPTKQMP" fullword ascii
		$s5 = "HWCLVGAJ" fullword ascii
		$s6 = "NKQVGLKLE" fullword ascii

Detection condition:
uint16(0) == 0x457f and filesize < 200KB and
		(
			( 1 of ($x*) and 1 of ($s*) ) or
			4 of ($s*)
		)

Full rule:
rule Mirai_Botnet_Malware {
	meta:
		description = "Detects Mirai Botnet Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-10-04"
      modified = "2023-01-27"
		hash1 = "05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c"
		hash2 = "05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c"
		hash3 = "20683ff7a5fec1237fc09224af40be029b9548c62c[PII_REDACTED]89af568c89d4"
		hash4 = "2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69"
		hash5 = "420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175"
		hash6 = "62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6"
		hash7 = "70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0"
		hash8 = "89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147"
		hash9 = "bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c[PII_REDACTED]737e72ea4e2dc4"
		hash10 = "c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f"
		hash11 = "d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89"
		hash12 = "f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5"
		hash13 = "fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b"
		id = "a678e9f7-d516-5bdb-962e-b9d39d8a64bb"
	strings:
		$x1 = "POST /cdn-cgi/" ascii
		$x2 = "/dev/misc/watchdog" fullword ascii
		$x3 = "/dev/watchdog" ascii
		$x5 = ".mdebug.abi32" fullword ascii

		$s1 = "LCOGQGPTGP" fullword ascii
		$s2 = "QUKLEKLUKVJOG" fullword ascii
		$s3 = "CFOKLKQVPCVMP" fullword ascii
		$s4 = "QWRGPTKQMP" fullword ascii
		$s5 = "HWCLVGAJ" fullword ascii
		$s6 = "NKQVGLKLE" fullword ascii
	condition:
		uint16(0) == 0x457f and filesize < 200KB and
		(
			( 1 of ($x*) and 1 of ($s*) ) or
			4 of ($s*)
		)
}
YARA Detection Rule: Mirai_1_May17
Repository: Neo23x0/signature-base
Detects: Detects Mirai Malware
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "GET /bins/mirai.x86 HTTP/1.0" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 5000KB and all of them )

Full rule:
rule Mirai_1_May17 {
   meta:
      description = "Detects Mirai Malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-05-12"
      super_rule = 1
      hash1 = "172d050cf0d4e4f[PII_REDACTED]857b51261c80209d9fa5a2f5f037f8ca14e85d2"
      hash2 = "9ba8def84a0bf14f682b3751b8f7a453da2cea47099734a[PII_REDACTED]5b2d39c"
      hash3 = "a393449a5f[PII_REDACTED]b13d60bb40601af2ef5f08839b5223f020f1f83e990"
      id = "ac85ee28-a01f-5c3d-a534-0c19a3dc92e7"
   strings:
      $s1 = "GET /bins/mirai.x86 HTTP/1.0" fullword ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 5000KB and all of them )
}
YARA Detection Rule: Miari_2_May17
Repository: Neo23x0/signature-base
Detects: Detects Mirai Malware
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.101 Safari/537.36" fullword ascii
      $s2 = "GET /g.php HTTP/1.1" fullword ascii
      $s3 = "https://%[^/]/%s" fullword ascii
      $s4 = "pass\" value=\"[^\"]*\"" fullword ascii
      $s5 = "jbeupq84v7.2y.net" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 5000KB and 2 of them )

Full rule:
rule Miari_2_May17 {
   meta:
      description = "Detects Mirai Malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-05-12"
      super_rule = 1
      hash1 = "9ba8def84a0bf14f682b3751b8f7a453da2cea47099734a[PII_REDACTED]5b2d39c"
      hash2 = "a393449a5f[PII_REDACTED]b13d60bb40601af2ef5f08839b5223f020f1f83e990"
      id = "1c2cc98d-8ca5-5055-8f86-7f85c046ccd9"
   strings:
      $s1 = "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.101 Safari/537.36" fullword ascii
      $s2 = "GET /g.php HTTP/1.1" fullword ascii
      $s3 = "https://%[^/]/%s" fullword ascii
      $s4 = "pass\" value=\"[^\"]*\"" fullword ascii
      $s5 = "jbeupq84v7.2y.net" fullword ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 5000KB and 2 of them )
}
YARA Detection Rule: MAL_ELF_LNX_Mirai_Oct10_1
Repository: Neo23x0/signature-base
Detects: Detects ELF Mirai variant
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = " -r /vi/mips.bushido; "
      $x2 = "/bin/busybox chmod 777 * /tmp/" ascii

      $s1 = "POST /ctrlt/DeviceUpgrade_1 HTTP/1.1" fullword ascii
      $s2 = "loadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>" fullword ascii
      $s3 = "POST /cdn-cgi/" ascii

Detection condition:
uint16(0) == 0x457f and filesize < 200KB and (
         ( 1 of ($x*) and 1 of ($s*) ) or
         all of ($x*)
      )

Full rule:
rule MAL_ELF_LNX_Mirai_Oct10_1 {
   meta:
      description = "Detects ELF Mirai variant"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2018-10-27"
      modified = "2023-01-27"
      hash1 = "3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe"
      id = "7bb28f03-03ba-581a-bc03-bd09a52787d9"
   strings:
      $x1 = " -r /vi/mips.bushido; "
      $x2 = "/bin/busybox chmod 777 * /tmp/" ascii

      $s1 = "POST /ctrlt/DeviceUpgrade_1 HTTP/1.1" fullword ascii
      $s2 = "loadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>" fullword ascii
      $s3 = "POST /cdn-cgi/" ascii
   condition:
      uint16(0) == 0x457f and filesize < 200KB and (
         ( 1 of ($x*) and 1 of ($s*) ) or
         all of ($x*)
      )
}
YARA Detection Rule: MAL_ELF_LNX_Mirai_Oct10_2
Repository: Neo23x0/signature-base
Detects: Detects ELF malware Mirai related
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$c01 = { 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00
               20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D
               41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A }

Detection condition:
uint16(0) == 0x457f and filesize < 200KB and all of them

Full rule:
rule MAL_ELF_LNX_Mirai_Oct10_2 {
   meta:
      description = "Detects ELF malware Mirai related"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2018-10-27"
      hash1 = "fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9"
      id = "421b7708-030e-50d1-bf2e-e91758a48c00"
   strings:
      $c01 = { 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00
               20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D
               41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A }
   condition:
      uint16(0) == 0x457f and filesize < 200KB and all of them
}
YARA Detection Rule: MAL_Mirai_Nov19_1
Repository: Neo23x0/signature-base
Detects: Detects Mirai malware
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/bad_packets/status/[PII_REDACTED]33282816

Pattern signatures:
$s1 = "SERVZUXO" fullword ascii
      $s2 = "-loldongs" fullword ascii
      $s3 = "/dev/null" fullword ascii
      $s4 = "/bin/busybox" fullword ascii
      $sc1 = { 47 72 6F 75 70 73 3A 09 30 }

Detection condition:
uint16(0) == 0x457f and filesize <= 100KB and 4 of them

Full rule:
rule MAL_Mirai_Nov19_1 {
   meta:
      description = "Detects Mirai malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/bad_packets/status/[PII_REDACTED]33282816"
      date = "2019-11-13"
      hash1 = "bbb83da15d4dabd395996ed120435e276a6ddfbadafb9a7f096597c869c6c739"
      hash2 = "fadbbe439f80cc33da0222f01973f27cce9f5ab0709f1bfbf1a954ceac5a579b"
      id = "40edcb29-9e10-5b87-ba79-8e3f629829e5"
   strings:
      $s1 = "SERVZUXO" fullword ascii
      $s2 = "-loldongs" fullword ascii
      $s3 = "/dev/null" fullword ascii
      $s4 = "/bin/busybox" fullword ascii
      $sc1 = { 47 72 6F 75 70 73 3A 09 30 }
   condition:
      uint16(0) == 0x457f and filesize <= 100KB and 4 of them
}
YARA Detection Rule: MAL_ARM_LNX_Mirai_Mar13_2022
Repository: Neo23x0/signature-base
Detects: Detects new ARM Mirai variant
Author: Mehmet Ali Kerimoglu a.k.a. CYB3RMX

Pattern signatures:
$str1 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm"
      $str2 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm"
      $str3 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm"
      $str4 = "/home/landley/aboriginal/aboriginal/build/simple-cross-compiler-armv6l/bin/../cc/include"
      $attck1 = "attack.c"
      $attck2 = "attacks.c"
      $attck3 = "anti_gdb_entry"
      $attck4 = "resolve_cnc_addr"
      $attck5 = "attack_gre_eth"
      $attck6 = "attack_udp_generic"
      $attck7 = "attack_get_opt_ip"
      $attck8 = "attack_icmpecho"

Detection condition:
uint16(0) == 0x457f and ( 3 of ($str*) or 4 of ($attck*) )

Full rule:
rule MAL_ARM_LNX_Mirai_Mar13_2022 {
   meta:
      description = "Detects new ARM Mirai variant"
      author = "Mehmet Ali Kerimoglu a.k.a. CYB3RMX"
      date = "2022-03-16"
      hash1 = "0283b72913b8a78b2a594b2d40ebc3c873e[PII_REDACTED]a1ff[PII_REDACTED]f5a68"
      id = "54d8860e-fc45-5571-b68c-66590c67a705"
   strings:
      $str1 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm"
      $str2 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm"
      $str3 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm"
      $str4 = "/home/landley/aboriginal/aboriginal/build/simple-cross-compiler-armv6l/bin/../cc/include"
      $attck1 = "attack.c"
      $attck2 = "attacks.c"
      $attck3 = "anti_gdb_entry"
      $attck4 = "resolve_cnc_addr"
      $attck5 = "attack_gre_eth"
      $attck6 = "attack_udp_generic"
      $attck7 = "attack_get_opt_ip"
      $attck8 = "attack_icmpecho"
   condition:
      uint16(0) == 0x457f and ( 3 of ($str*) or 4 of ($attck*) )
}
YARA Detection Rule: MAL_CRIME_suspicious_hex_string_Jun21_1
Repository: Neo23x0/signature-base
Detects: Triggers on parts of a big hex string available in lots of crime'ish PE files.
Author: Nils Kuhnert

Pattern signatures:
$a1 = "[PII_REDACTED]0C[PII_REDACTED]170C0412147F6A6A0C041F321104130C[PII_REDACTED]030C[PII_REDACTED]130C[PII_REDACTED]130C[PII_REDACTED]130C[PII_REDACTED]130C[PII_REDACTED]130C[PII_REDACTED]130C[PII_REDACTED]130C[PII_REDACTED]272A711221112B1C[PII_REDACTED][PII_REDACTED]3D20262B0F323038692B312003271C170B3A2F[PII_REDACTED]10241F[PII_REDACTED][PII_REDACTED]2200087C071C[PII_REDACTED][PII_REDACTED]60F[PII_REDACTED]C[PII_REDACTED]001C[PII_REDACTED]160C0C002D2412130C[PII_REDACTED]130C04121A[PII_REDACTED]F140122130C0134171" ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 10MB and all of them

Full rule:
rule MAL_CRIME_suspicious_hex_string_Jun21_1 : CRIME PE {
    meta:
        author = "Nils Kuhnert"
        date = "2021-06-04"
        description = "Triggers on parts of a big hex string available in lots of crime'ish PE files."
        hash1 = "37d60eb2daea90a9ba275e16115848c95e6ad87d20e4a94ab21bd5c5875a0a34"
        hash2 = "3380c8c56d1216fe112cbc8f1d329b59e2cd2944575fe403df5e5108ca21fc69"
        hash3 = "cd283d89b1b5e9d[PII_REDACTED]009b5cf6b137e3441d06712f49e22e963e39888"
        hash4 = "404efa6fb5a24cd8f1e88e71a1d89da0aca395f82d8251e7fe7df625cd8e80aa"
        hash5 = "479bf3fb8cff50a5de3d3742ab4b485b563b8faf171583b1015f80522ff4853e"
        id = "2ad208fa-c7a5-5df9-96fe-4a84dc770f0f"
    strings:
        $a1 = "[PII_REDACTED]0C[PII_REDACTED]170C0412147F6A6A0C041F321104130C[PII_REDACTED]030C[PII_REDACTED]130C[PII_REDACTED]130C[PII_REDACTED]130C[PII_REDACTED]130C[PII_REDACTED]130C[PII_REDACTED]130C[PII_REDACTED]130C[PII_REDACTED]272A711221112B1C[PII_REDACTED][PII_REDACTED]3D20262B0F323038692B312003271C170B3A2F[PII_REDACTED]10241F[PII_REDACTED][PII_REDACTED]2200087C071C[PII_REDACTED][PII_REDACTED]60F[PII_REDACTED]C[PII_REDACTED]001C[PII_REDACTED]160C0C002D2412130C[PII_REDACTED]130C04121A[PII_REDACTED]F140122130C0134171" ascii
    condition:
        uint16(0) == 0x5a4d and filesize < 10MB and all of them
}
YARA Detection Rule: MAL_CRIME_Unknown_LNK_Jun21_1
Repository: Neo23x0/signature-base
Detects: Triggers on malicious link files which calls powershell with an obfuscated payload and downloads an HTA file.
Author: Nils Kuhnert

Pattern signatures:
$uid = "S-1-5-2[PII_REDACTED][PII_REDACTED]-385[PII_REDACTED]" wide

Detection condition:
uint16(0) == 0x004c and all of them

Full rule:
rule MAL_CRIME_Unknown_LNK_Jun21_1: LNK POWERSHELL {
    meta:
        author = "Nils Kuhnert"
        date = "2021-06-04"
        description = "Triggers on malicious link files which calls powershell with an obfuscated payload and downloads an HTA file."
        hash1 = "8fc7f25da954adcb8f91d5b0e1967e4a90ca132b280aa6ae73e150b55d301942"
        hash2 = "f5da192f4e4dfb6b728aee1821d10bec6d68fb21266ce32b688e8cae7898a522"
        hash3 = "183a9b3c04d16a1822c788d7a6e78943790ee2cdeea12a38e[PII_REDACTED]16e45"
        hash4 = "a38c6aa3e1c429a27226519b38f39f03b0b1b9d75fd43cd7e067c5e542967afe"
        hash5 = "455f7b6b975fb8f7afc6295ec40dae5696f5063d1651f3b2477f10976a3b67b2"
        id = "d1aac420-fd91-5577-8efd-fcdd7f733981"
    strings:
        $uid = "S-1-5-2[PII_REDACTED][PII_REDACTED]-385[PII_REDACTED]" wide
    condition:
        uint16(0) == 0x004c and all of them
}
YARA Detection Rule: MAL_CRIME_Unknown_ISO_Jun21_1
Repository: Neo23x0/signature-base
Detects: Triggers on ISO files that mimick NOBELIUM TTPs, but uses LNK files that call powershell instead.
Author: Nils Kuhnert

Pattern signatures:
$uid = "S-1-5-2[PII_REDACTED][PII_REDACTED]-385[PII_REDACTED]" wide
        $magic = "CD001" ascii

Detection condition:
filesize < 5MB and all of them

Full rule:
rule MAL_CRIME_Unknown_ISO_Jun21_1 : ISO POWERSHELL LNK {
    meta:
        author = "Nils Kuhnert"
        date = "2021-06-04"
        description = "Triggers on ISO files that mimick NOBELIUM TTPs, but uses LNK files that call powershell instead."
        hash1 = "425dbed047dd2ce760d0848ebf7ad04b1ca360f111d557fc7bf657ae89f86d36"
        hash2 = "f6944b6bca627e219d9c5065f214f95eb2226897a3b823b645d0fd78c281b149"
        hash3 = "14d70a8bdd64e9a936c2dc9caa6d[PII_REDACTED]e0e3870e3a25d9d59bcafb046e"
        hash4 = "9b2ca8eb6db34b07647a74171a5ff4c0a2ca8000da9876ed2db6361958c5c080"
        id = "73a1fc44-45c4-5253-b81d-fa6686dc0644"
    strings:
        $uid = "S-1-5-2[PII_REDACTED][PII_REDACTED]-385[PII_REDACTED]" wide
        $magic = "CD001" ascii
    condition:
        filesize < 5MB and all of them
}
YARA Detection Rule: EXT_NK_GOLDBACKDOOR_inital_shellcode
Repository: Neo23x0/signature-base
Detects: Detection for initial shellcode loader used to deploy GOLDBACDOOR
Author: Silas Cutler (silas@Stairwell.com)
Reference: https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf

Pattern signatures:
$ = { C7 45 C4 25 6C 6F 63 50 8D 45 C4 C7 45 C8 61 6C 61 70 8B F9 C7 45
              CC 70 64 61 74 50 B9 BD 88 17 75 C7 45 D0 61 25 5C 6C 8B DA C7 45 D4 6F
              67 5F 67 C7 45 D8 6F 6C 64 2E C7 45 DC 74 78 74 00 }
        // Import loaders
        $ = { 51 50 57 56 B9 E6 8E 85 35 E8 ?? ?? ?? ?? FF D0 }
        $ = { 6A 40 68 00 10 00 00 52 6A 00 FF 75 E0 B9 E3 18 90 72 E8 ?? ?? ?? ?? FF D0}

Detection condition:
all of them

Full rule:
rule EXT_NK_GOLDBACKDOOR_inital_shellcode {
    meta:
        author= "Silas Cutler (silas@Stairwell.com)"
        description = "Detection for initial shellcode loader used to deploy GOLDBACDOOR"
        version = "0.1"
        date = "2022-04-21"
        reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
        score = 80
        id = "daab8e54-11b3-51cc-8bee-55b078f3e791"
    strings:
        $ = { C7 45 C4 25 6C 6F 63 50 8D 45 C4 C7 45 C8 61 6C 61 70 8B F9 C7 45
              CC 70 64 61 74 50 B9 BD 88 17 75 C7 45 D0 61 25 5C 6C 8B DA C7 45 D4 6F
              67 5F 67 C7 45 D8 6F 6C 64 2E C7 45 DC 74 78 74 00 }
        // Import loaders
        $ = { 51 50 57 56 B9 E6 8E 85 35 E8 ?? ?? ?? ?? FF D0 }
        $ = { 6A 40 68 00 10 00 00 52 6A 00 FF 75 E0 B9 E3 18 90 72 E8 ?? ?? ?? ?? FF D0}
    condition:
        all of them
}
YARA Detection Rule: EXT_NK_GOLDBACKDOOR_injected_shellcode
Repository: Neo23x0/signature-base
Detects: Detection for injected shellcode that decodes GOLDBACKDOOR
Author: Silas Cutler (silas@Stairwell.com)
Reference: https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf

Pattern signatures:
$dec_routine = { 8A 19 57 8B FA 8B 51 01 83 C1 05 85 D2 74 0E 56 8B C1 8B F2 30 18 40 83 EE 01 75 F8 5E 57 }
        $rtlfillmemory_load = { B9 4B 17 CD 5B 55 56 33 ED 55 6A 10 50 E8 86 00 00 00 FF D0 }
        $ = "StartModule"
        $log_file_name = { C7 44 24 3C 25 6C 6F 63 50 8D 44 24 40 C7 44 24 44 61 6C 
                           61 70 50 B9 BD 88 17 75 C7 44 24 4C 70 64 61 74 C7 44 24 
                           50 61 25 5C 6C C7 44 24 54 6F 67 5F 67 C7 44 24 58 6F 6C
                           64 32 C7 44 24 5C 2E 74 78 74 }
         $ = { B9 8E 8A DD 8D 8B F0 E8 E9 FB FF FF FF D0 }

Detection condition:
3 of them

Full rule:
rule EXT_NK_GOLDBACKDOOR_injected_shellcode {
    meta:
        author= "Silas Cutler (silas@Stairwell.com)"
        description = "Detection for injected shellcode that decodes GOLDBACKDOOR"
        version = "0.1"
        date = "2022-04-21"
        reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
        score = 80
        id = "aa921f01-98cc-51ab-877a-e7beede77e36"
    strings:
        $dec_routine = { 8A 19 57 8B FA 8B 51 01 83 C1 05 85 D2 74 0E 56 8B C1 8B F2 30 18 40 83 EE 01 75 F8 5E 57 }
        $rtlfillmemory_load = { B9 4B 17 CD 5B 55 56 33 ED 55 6A 10 50 E8 86 00 00 00 FF D0 }
        $ = "StartModule"
        $log_file_name = { C7 44 24 3C 25 6C 6F 63 50 8D 44 24 40 C7 44 24 44 61 6C 
                           61 70 50 B9 BD 88 17 75 C7 44 24 4C 70 64 61 74 C7 44 24 
                           50 61 25 5C 6C C7 44 24 54 6F 67 5F 67 C7 44 24 58 6F 6C
                           64 32 C7 44 24 5C 2E 74 78 74 }
         $ = { B9 8E 8A DD 8D 8B F0 E8 E9 FB FF FF FF D0 }
    condition:
       3 of them
}
YARA Detection Rule: EXT_NK_GOLDBACKDOOR_generic_shellcode
Repository: Neo23x0/signature-base
Detects: Generic detection for shellcode used to drop GOLDBACKDOOR
Author: Silas Cutler (silas@Stairwell.com)
Reference: https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf

Pattern signatures:
$ = { B9 8E 8A DD 8D 8B F0 E8 ?? ?? ?? ?? FF D0 }
        $ = { B9 8E AB 6F 40 [1-10] 50 [1-10] E8 ?? ?? ?? ?? FF D0 }

Detection condition:
all of them

Full rule:
rule EXT_NK_GOLDBACKDOOR_generic_shellcode {
    meta:
        author= "Silas Cutler (silas@Stairwell.com)"
        description = "Generic detection for shellcode used to drop GOLDBACKDOOR"
        version = "0.1"
        date = "2022-04-21"
        reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
        score = 75
        id = "70081d63-0b26-5358-8444-5adc3a44aaa0"
    strings:
        $ = { B9 8E 8A DD 8D 8B F0 E8 ?? ?? ?? ?? FF D0 }
        $ = { B9 8E AB 6F 40 [1-10] 50 [1-10] E8 ?? ?? ?? ?? FF D0 }
    condition:
        all of them
}
YARA Detection Rule: ShadowPad_nssock2
Repository: Neo23x0/signature-base
Detects: Detects malicious nssock2.dll from ShadowPad incident - file nssock2.dll
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/shadowpad-in-corporate-networks/81432/

Detection condition:
( uint16(0) == 0x5a4d and
        filesize < 500KB and
        (
           pe.imphash() == "c67de089f2009b[PII_REDACTED]2fc484e8" or
           pe.imphash() == "11522f7d4b2fc05acba8f534ca1b828a"
        )
      )

Full rule:
rule ShadowPad_nssock2 {
   meta:
      description = "Detects malicious nssock2.dll from ShadowPad incident - file nssock2.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/shadowpad-in-corporate-networks/81432/"
      date = "2017-08-15"
      hash1 = "462a02a8094e833fd456baf0a6d4e18bb7dab1a9f74d5f163a8334921a4ffde8"
      hash2 = "c45116a22cf5695b618fcdf1002619e8544ba015d06b2e1dbf47982600c7545f"
      hash3 = "696be784c67896b9239a8af0a167add72b1becd3ef98d03e99207a3d5734f6eb"
      hash4 = "515d3110498d7b4fdb451ed60bb11cd6835fcff4780cb2b982ffd2740e1347a0"
      hash5 = "536d7e3bd1c9e1c2fd8438ab75d6c29c921974560b47c71686714d12fb8e9882"
      hash6 = "637fa40cf7dd0252c87140f7895768f42a370551c87c37a3a77aac00eb17d72e"
      id = "47ecc7f8-065a-558b-9bba-300fd28f4eab"
   condition:
      ( uint16(0) == 0x5a4d and
        filesize < 500KB and
        (
           pe.imphash() == "c67de089f2009b[PII_REDACTED]2fc484e8" or
           pe.imphash() == "11522f7d4b2fc05acba8f534ca1b828a"
        )
      )
}