deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Njrat
Repository: Yara-Rules/rules
Detects: Njrat
Author: botherder https://github.com/botherder

Pattern signatures:
$string1 = /(F)romBase64String/
        $string2 = /(B)ase64String/
        $string3 = /(C)onnected/ wide ascii
        $string4 = /(R)eceive/
        $string5 = /(S)end/ wide ascii
        $string6 = /(D)ownloadData/ wide ascii
        $string7 = /(D)eleteSubKey/ wide ascii
        $string8 = /(g)et_MachineName/
        $string9 = /(g)et_UserName/
        $string10 = /(g)et_LastWriteTime/
        $string11 = /(G)etVolumeInformation/
        $string12 = /(O)SFullName/ wide ascii
        $string13 = /(n)etsh firewall/ wide
        $string14 = /(c)md\.exe \/k ping 0 & del/ wide
        $string15 = /(c)md\.exe \/c ping 127\.0\.0\.1 & del/ wide
        $string16 = /(c)md\.exe \/c ping 0 -n 2 & del/ wide
        $string17 = {7C 00 27 00 7C 00 27 00 7C}

Detection condition:
10 of them

Full rule:
rule Njrat: RAT
{
    meta:
        description = "Njrat"
	author = "botherder https://github.com/botherder"

    strings:
        $string1 = /(F)romBase64String/
        $string2 = /(B)ase64String/
        $string3 = /(C)onnected/ wide ascii
        $string4 = /(R)eceive/
        $string5 = /(S)end/ wide ascii
        $string6 = /(D)ownloadData/ wide ascii
        $string7 = /(D)eleteSubKey/ wide ascii
        $string8 = /(g)et_MachineName/
        $string9 = /(g)et_UserName/
        $string10 = /(g)et_LastWriteTime/
        $string11 = /(G)etVolumeInformation/
        $string12 = /(O)SFullName/ wide ascii
        $string13 = /(n)etsh firewall/ wide
        $string14 = /(c)md\.exe \/k ping 0 & del/ wide
        $string15 = /(c)md\.exe \/c ping 127\.0\.0\.1 & del/ wide
        $string16 = /(c)md\.exe \/c ping 0 -n 2 & del/ wide
        $string17 = {7C 00 27 00 7C 00 27 00 7C}

    condition:
        10 of them
}
YARA Detection Rule: njrat1
Repository: Yara-Rules/rules
Detects: Identify njRat
Author: Brian Wallace @botnet_hunter

Pattern signatures:
$a1 = "netsh firewall add allowedprogram " wide
        $a2 = "SEE_MASK_NOZONECHECKS" wide

        $b1 = "[TAP]" wide
        $b2 = " & exit" wide

        $c1 = "md.exe /k ping 0 & del " wide
        $c2 = "cmd.exe /c ping 127.0.0.1 & del" wide
        $c3 = "cmd.exe /c ping" wide

Detection condition:
1 of ($a*) and 1 of ($b*) and 1 of ($c*)

Full rule:
rule njrat1: RAT
{
    meta:
        author = "Brian Wallace @botnet_hunter"
        author_email = "bwall@ballastsecurity.net"
        date = "2015-05-27"
        description = "Identify njRat"
    strings:
        $a1 = "netsh firewall add allowedprogram " wide
        $a2 = "SEE_MASK_NOZONECHECKS" wide

        $b1 = "[TAP]" wide
        $b2 = " & exit" wide

        $c1 = "md.exe /k ping 0 & del " wide
        $c2 = "cmd.exe /c ping 127.0.0.1 & del" wide
        $c3 = "cmd.exe /c ping" wide
    condition:
        1 of ($a*) and 1 of ($b*) and 1 of ($c*)
}
YARA Detection Rule: win_exe_njRAT
Repository: Yara-Rules/rules
Detects: Variants have also been observed obfuscated with .NET Reactor
Author: info@fidelissecurity.com

Pattern signatures:
$magic = "MZ"
$string_setA_1 = "FromBase64String"
$string_setA_2 = "Base64String"
$string_setA_3 = "Connected" wide ascii
$string_setA_4 = "Receive"
$string_setA_5 = "DeleteSubKey" wide ascii
$string_setA_6 = "get_MachineName"
$string_setA_7 = "get_UserName"
$string_setA_8 = "get_LastWriteTime"
$string_setA_9 = "GetVolumeInformation"

$string_setB_1 = "OSFullName" wide ascii
$string_setB_2 = "Send" wide ascii
$string_setB_3 = "Connected" wide ascii
$string_setB_4 = "DownloadData" wide ascii
$string_setB_5 = "netsh firewall" wide
$string_setB_6 = "cmd.exe /k ping 0 & del" wide

Detection condition:
($magic at 0) and ( all of ($string_setA*) or all of ($string_setB*) )

Full rule:
rule win_exe_njRAT 
{
meta:
author = "info@fidelissecurity.com"
descripion = "njRAT - Remote Access Trojan"
comment = "Variants have also been observed obfuscated with .NET Reactor"
filetype = "pe"
date = "2013-07-15"
version = "1.0"
hash1 = "92ee1fb5df21d8cfafa2b02b6a25bd3b"
hash2 = "3576d40ce18bb0349f9dfa42b8911c3a"
hash3 = "24cc5b811a7f9591e7f2cb9a818be104"
hash4 = "3ad5fded9d7fdf1c2f6102f4874b2d52"
hash5 = "a98b4c99f64315aac9dd992593830f35"
hash6 ="5fcb5282da1a2a0f053051c8da1686ef"
hash7 = "a669c0da6309a930af16381b18ba2f9d"
hash8 = "79dce17498e[PII_REDACTED]b162b09bde8"
hash9 = "fc96a7e27b1d3dab715b2732d5c86f80"
ref1 = "http://bit.ly/19tlf4s"
ref2 = "http://www.fidelissecurity.com/threatadvisory"
ref3 = "http://www.threatgeek.com/2013/06/fidelis-threat-advisory-1009-njratuncovered.html"
ref4 = "http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered.pdf"

strings:
$magic = "MZ"
$string_setA_1 = "FromBase64String"
$string_setA_2 = "Base64String"
$string_setA_3 = "Connected" wide ascii
$string_setA_4 = "Receive"
$string_setA_5 = "DeleteSubKey" wide ascii
$string_setA_6 = "get_MachineName"
$string_setA_7 = "get_UserName"
$string_setA_8 = "get_LastWriteTime"
$string_setA_9 = "GetVolumeInformation"

$string_setB_1 = "OSFullName" wide ascii
$string_setB_2 = "Send" wide ascii
$string_setB_3 = "Connected" wide ascii
$string_setB_4 = "DownloadData" wide ascii
$string_setB_5 = "netsh firewall" wide
$string_setB_6 = "cmd.exe /k ping 0 & del" wide

condition:
($magic at 0) and ( all of ($string_setA*) or all of ($string_setB*) ) 
}
YARA Detection Rule: network_traffic_njRAT
Repository: Yara-Rules/rules
Detects: Rule to alert on network traffic indicators
Author: info@fidelissecurity.com

Pattern signatures:
$string1 = "FM|'|'|"     // File Manager
$string2 = "nd|'|'|"     // File Manager
$string3 = "rn|'|'|"      // Run File
$string4 = "sc~|'|'|"     // Remote Desktop
$string5 = "scPK|'|'|"     // Remote Desktop
$string6 = "CAM|'|'|"     // Remote Cam
$string7 = "USB Video Device[endof]" // Remote Cam
$string8 = "rs|'|'|"     // Reverse Shell
$string9 = "proc|'|'|"     // Process Manager
$string10 = "k|'|'|"     // Process Manager
$string11 = "RG|'|'|~|'|'|"    // Registry Manipulation
$string12 = "kl|'|'|"     // Keylogger file
$string13 = "ret|'|'|"     // Get Browser Passwords
$string14 = "pl|'|'|"     // Get Browser Passwords
$string15 = "lv|'|'|"     // General
$string16 = "prof|'|'|~|'|'|"   // Server rename
$string17 = "un|'|'|~[endof]"   // Uninstall
$idle_string = "P[endof]"    // Idle Connection

Detection condition:
any of ($string*) or #idle_string > 4

Full rule:
rule network_traffic_njRAT 
{
meta:
author = "info@fidelissecurity.com"
descripion = "njRAT - Remote Access Trojan"
comment = "Rule to alert on network traffic indicators"
filetype = "PCAP - Network Traffic"
date = "2013-07-15"
version = "1.0"
hash1 = "92ee1fb5df21d8cfafa2b02b6a25bd3b"
hash2 ="3576d40ce18bb0349f9dfa42b8911c3a"
hash3 ="24cc5b811a7f9591e7f2cb9a818be104"
hash4 = "3ad5fded9d7fdf1c2f6102f4874b2d52"
hash5 = "a98b4c99f64315aac9dd992593830f35"
hash6 = "5fcb5282da1a2a0f053051c8da1686ef"
hash7 = "a669c0da6309a930af16381b18ba2f9d"
hash8 = "79dce17498e[PII_REDACTED]b162b09bde8"
hash9 = "fc96a7e27b1d3dab715b2732d5c86f80"
ref1 = "http://bit.ly/19tlf4s"
ref2 = "http://www.fidelissecurity.com/threatadvisory"
ref3 = "http://www.threatgeek.com/2013/06/fidelis-threat-advisory-1009-njrat-uncovered.html"
ref4 = "http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered.pdf"

strings:
$string1 = "FM|'|'|"     // File Manager
$string2 = "nd|'|'|"     // File Manager
$string3 = "rn|'|'|"      // Run File
$string4 = "sc~|'|'|"     // Remote Desktop
$string5 = "scPK|'|'|"     // Remote Desktop
$string6 = "CAM|'|'|"     // Remote Cam
$string7 = "USB Video Device[endof]" // Remote Cam
$string8 = "rs|'|'|"     // Reverse Shell
$string9 = "proc|'|'|"     // Process Manager
$string10 = "k|'|'|"     // Process Manager
$string11 = "RG|'|'|~|'|'|"    // Registry Manipulation
$string12 = "kl|'|'|"     // Keylogger file
$string13 = "ret|'|'|"     // Get Browser Passwords
$string14 = "pl|'|'|"     // Get Browser Passwords
$string15 = "lv|'|'|"     // General
$string16 = "prof|'|'|~|'|'|"   // Server rename
$string17 = "un|'|'|~[endof]"   // Uninstall
$idle_string = "P[endof]"    // Idle Connection

condition:
any of ($string*) or #idle_string > 4  

}
YARA Detection Rule: is__elf
Repository: Yara-Rules/rules
Author: @mmorenog,@yararules

Pattern signatures:
$header = { 7F 45 4C 46 }

Detection condition:
$header at 0

Full rule:
private rule is__elf {
	meta:
		author = "@mmorenog,@yararules"
	strings:
		$header = { 7F 45 4C 46 }
	condition:
		$header at 0
}
YARA Detection Rule: is__Mirai_gen7
Repository: Yara-Rules/rules
Detects: Generic detection for MiraiX version 7
Author: unixfreaxjp
Reference: http://blog.malwaremustdie.org/2016/08/mmd-0056-2016-linuxmirai-just.html

Pattern signatures:
$st01 = "/bin/busybox rm" fullword nocase wide ascii
                $st02 = "/bin/busybox echo" fullword nocase wide ascii
                $st03 = "/bin/busybox wget" fullword nocase wide ascii
                $st04 = "/bin/busybox tftp" fullword nocase wide ascii
                $st05 = "/bin/busybox cp" fullword nocase wide ascii
                $st06 = "/bin/busybox chmod" fullword nocase wide ascii
                $st07 = "/bin/busybox cat" fullword nocase wide ascii

Detection condition:
5 of them

Full rule:
rule is__Mirai_gen7 {
        meta:
                description = "Generic detection for MiraiX version 7"
                reference = "http://blog.malwaremustdie.org/2016/08/mmd-0056-2016-linuxmirai-just.html"
                author = "unixfreaxjp"
                org = "MalwareMustDie"
                date = "2018-01-05"

        strings:
                $st01 = "/bin/busybox rm" fullword nocase wide ascii
                $st02 = "/bin/busybox echo" fullword nocase wide ascii
                $st03 = "/bin/busybox wget" fullword nocase wide ascii
                $st04 = "/bin/busybox tftp" fullword nocase wide ascii
                $st05 = "/bin/busybox cp" fullword nocase wide ascii
                $st06 = "/bin/busybox chmod" fullword nocase wide ascii
                $st07 = "/bin/busybox cat" fullword nocase wide ascii

        condition:
                5 of them
}
YARA Detection Rule: diamond_fox
Repository: Yara-Rules/rules
Detects: Identify DiamondFox
Author: Brian Wallace @botnet_hunter

Pattern signatures:
$s1 = "UPDATE_B"
        $s2 = "UNISTALL_B"
        $s3 = "S_PROTECT"
        $s4 = "P_WALLET"
        $s5 = "GR_COMMAND"
        $s6 = "FTPUPLOAD"

Detection condition:
all of them

Full rule:
rule diamond_fox
{
   
    meta:
        author = "Brian Wallace @botnet_hunter"
        author_email = "bwall@ballastsecurity.net"
        date = "2015-08-22"
        description = "Identify DiamondFox"
   
    strings:
        $s1 = "UPDATE_B"
        $s2 = "UNISTALL_B"
        $s3 = "S_PROTECT"
        $s4 = "P_WALLET"
        $s5 = "GR_COMMAND"
        $s6 = "FTPUPLOAD"
   
    condition:
        all of them
}
YARA Detection Rule: Adzok
Repository: Yara-Rules/rules
Detects: Adzok Rat
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a1 = "config.xmlPK"
		$a2 = "key.classPK"
		$a3 = "svd$1.classPK"
		$a4 = "svd$2.classPK"
    	$a5 = "Mensaje.classPK"
		$a6 = "inic$ShutdownHook.class"
		$a7 = "Uninstall.jarPK"
		$a8 = "resources/icono.pngPK"

Detection condition:
7 of ($a*)

Full rule:
rule Adzok : binary RAT Adzok
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		Description = "Adzok Rat"
		Versions = "Free 1.0.0.3,"
		date = "2015/05"
		ref = "http://malwareconfig.com/stats/Adzok"
		maltype = "Remote Access Trojan"
		filetype = "jar"

	strings:
		$a1 = "config.xmlPK"
		$a2 = "key.classPK"
		$a3 = "svd$1.classPK"
		$a4 = "svd$2.classPK"
    	$a5 = "Mensaje.classPK"
		$a6 = "inic$ShutdownHook.class"
		$a7 = "Uninstall.jarPK"
		$a8 = "resources/icono.pngPK"
        
	condition:
    7 of ($a*)
}
YARA Detection Rule: is__Mirai_Satori_gen
Repository: Yara-Rules/rules
Detects: Detects Mirai Satori_gen
Reference: https://www.reddit.com/r/LinuxMalware/comments/7p00i3/quick_notes_for_okiru_satori_variant_of_mirai/

Pattern signatures:
$st08 = "tftp -r satori" fullword nocase wide ascii
		$st09 = "/bins/satori" fullword nocase wide ascii
		$st10 = "satori" fullword nocase wide ascii
		$st11 = "SATORI" fullword nocase wide ascii

Detection condition:
2 of them

Full rule:
private rule is__Mirai_Satori_gen {
	meta:
		description = "Detects Mirai Satori_gen"
		reference = "https://www.reddit.com/r/LinuxMalware/comments/7p00i3/quick_notes_for_okiru_satori_variant_of_mirai/"
		date = "2018-01-05"

	strings:
		$st08 = "tftp -r satori" fullword nocase wide ascii
		$st09 = "/bins/satori" fullword nocase wide ascii
		$st10 = "satori" fullword nocase wide ascii
		$st11 = "SATORI" fullword nocase wide ascii

	condition:
		2 of them
}
YARA Detection Rule: Mirai_Satori
Repository: Yara-Rules/rules
Detects: Detects Mirai Satori MALW

Pattern signatures:
$hexsts01 = { 63 71 75 ?? 62 6B 77 62 75 }
		$hexsts02 = { 53 54 68 72 75 64 62 }
		$hexsts03 = { 28 63 62 71 28 70 66 73 64 6F 63 68 60 }

Detection condition:
all of them
		and is__elf
		and is__Mirai_gen7
		and is__Mirai_Satori_gen
		and filesize < 100KB

Full rule:
rule Mirai_Satori {
	meta:
		description = "Detects Mirai Satori MALW"
		date = "2018-01-09"

	strings:
		$hexsts01 = { 63 71 75 ?? 62 6B 77 62 75 }
		$hexsts02 = { 53 54 68 72 75 64 62 }
		$hexsts03 = { 28 63 62 71 28 70 66 73 64 6F 63 68 60 } 

	condition:
		all of them
		and is__elf
		and is__Mirai_gen7
		and is__Mirai_Satori_gen
		and filesize < 100KB 
}
YARA Detection Rule: Tedroo
Repository: Yara-Rules/rules
Detects: Tedroo Spammer
Author: Kevin Falcoz

Pattern signatures:
$signature1={25 73 25 73 2E 65 78 65}
		$signature2={5F 6C 6F 67 2E 74 78 74}

Detection condition:
$signature1 and $signature2

Full rule:
rule Tedroo : Spammer
{
	meta:
		author="Kevin Falcoz"
		date="22/11/2015"
		description="Tedroo Spammer"

	strings:
		$signature1={25 73 25 73 2E 65 78 65}
		$signature2={5F 6C 6F 67 2E 74 78 74}

	condition:
		$signature1 and $signature2
}
YARA Detection Rule: Kraken_Bot_Sample
Repository: Yara-Rules/rules
Detects: Kraken Bot Sample - file inf.bin
Author: Florian Roth
Reference: https://blog.gdatasoftware.com/blog/article/dissecting-the-kraken.html

Pattern signatures:
$s2 = "%s=?getname" fullword ascii
		$s4 = "&COMPUTER=^" fullword ascii
		$s5 = "xJWFwcGRhdGElAA=" fullword ascii /* base64 encoded string '%appdata%' */
		$s8 = "JVdJTkRJUi" fullword ascii /* base64 encoded string '%WINDIR' */
		$s20 = "btcplug" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and all of them

Full rule:
rule Kraken_Bot_Sample : bot {
	meta:
		description = "Kraken Bot Sample - file inf.bin"
		author = "Florian Roth"
		reference = "https://blog.gdatasoftware.com/blog/article/dissecting-the-kraken.html"
		date = "2015-05-07"
		hash = "798e9f43fc199269a3ec68980eb4d91eb195436d"
		score = 90
	strings:
		$s2 = "%s=?getname" fullword ascii
		$s4 = "&COMPUTER=^" fullword ascii
		$s5 = "xJWFwcGRhdGElAA=" fullword ascii /* base64 encoded string '%appdata%' */
		$s8 = "JVdJTkRJUi" fullword ascii /* base64 encoded string '%WINDIR' */
		$s20 = "btcplug" fullword ascii
	condition:
		uint16(0) == 0x5a4d and all of them
}
YARA Detection Rule: eicar
Repository: Yara-Rules/rules
Detects: Rule to detect Eicar pattern
Author: Marc Rivero | @seifreed

Pattern signatures:
$s1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" fullword ascii

Detection condition:
all of them

Full rule:
rule eicar 
{
	meta:
		description = "Rule to detect Eicar pattern"
		author = "Marc Rivero | @seifreed"
		hash1 = "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f"

	strings:
		$s1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" fullword ascii

	condition:
		all of them
}
YARA Detection Rule: SNOWGLOBE_Babar_Malware
Repository: Yara-Rules/rules
Detects: Detects the Babar Malware used in the SNOWGLOBE attacks - file babar.exe
Author: Florian Roth
Reference: http://motherboard.vice.com/read/meet-babar-a-new-malware-almost-certainly-created-by-france

Pattern signatures:
$mz = { 4d 5a }
        $z0 = "admin\\Desktop\\Babar64\\Babar64\\obj\\DllWrapper" ascii fullword
        $z1 = "User-Agent: Mozilla/4.0 (compatible; MSI 6.0;" ascii fullword
        $z2 = "ExecQueryFailled!" fullword ascii
        $z3 = "NBOT_COMMAND_LINE" fullword
        $z4 = "!!!EXTRACT ERROR!!!File Does Not Exists-->[%s]" fullword
        $s1 = "/s /n %s \"%s\"" fullword ascii
        $s2 = "%%WINDIR%%\\%s\\%s" fullword ascii
        $s3 = "/c start /wait " fullword ascii
        $s4 = "(D;OICI;FA;;;AN)(A;OICI;FA;;;BG)(A;OICI;FA;;;SY)(A;OICI;FA;;;LS)" ascii
        $x1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\" fullword ascii
        $x2 = "%COMMON_APPDATA%" fullword ascii
        $x4 = "CONOUT$" fullword ascii
        $x5 = "cmd.exe" fullword ascii
        $x6 = "DLLPATH" fullword ascii

Detection condition:
( $mz at 0 ) and filesize < 1MB and (( 1 of ($z*) and 1 of ($x*) ) or ( 3 of ($s*) and 4 of ($x*) ) )

Full rule:
rule SNOWGLOBE_Babar_Malware 
{

    meta:
        description = "Detects the Babar Malware used in the SNOWGLOBE attacks - file babar.exe"
        author = "Florian Roth"
        reference = "http://motherboard.vice.com/read/meet-babar-a-new-malware-almost-certainly-created-by-france"
        date = "2015/02/18"
        hash = "27a0a98053f3eed82a51cdefbdfec7bb948e1f36"
        score = 80

    strings:
        $mz = { 4d 5a }
        $z0 = "admin\\Desktop\\Babar64\\Babar64\\obj\\DllWrapper" ascii fullword
        $z1 = "User-Agent: Mozilla/4.0 (compatible; MSI 6.0;" ascii fullword
        $z2 = "ExecQueryFailled!" fullword ascii
        $z3 = "NBOT_COMMAND_LINE" fullword
        $z4 = "!!!EXTRACT ERROR!!!File Does Not Exists-->[%s]" fullword
        $s1 = "/s /n %s \"%s\"" fullword ascii
        $s2 = "%%WINDIR%%\\%s\\%s" fullword ascii
        $s3 = "/c start /wait " fullword ascii
        $s4 = "(D;OICI;FA;;;AN)(A;OICI;FA;;;BG)(A;OICI;FA;;;SY)(A;OICI;FA;;;LS)" ascii
        $x1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\" fullword ascii
        $x2 = "%COMMON_APPDATA%" fullword ascii
        $x4 = "CONOUT$" fullword ascii
        $x5 = "cmd.exe" fullword ascii
        $x6 = "DLLPATH" fullword ascii
    
    condition:
        ( $mz at 0 ) and filesize < 1MB and (( 1 of ($z*) and 1 of ($x*) ) or ( 3 of ($s*) and 4 of ($x*) ) )
}
YARA Detection Rule: APT_fancybear_Downdelph_magic
Repository: Yara-Rules/rules
Detects: APT28 downdelph magic string
Author: Marc Salinas @Bondey_m
Reference: https://www.threatminer.org/_reports/2016/eset-sednit-part3%20-%20ESET.pdf#viewer.action=download

Pattern signatures:
$str1 = " :3 "

Detection condition:
$str1 at 0

Full rule:
rule APT_fancybear_Downdelph_magic : Bootkit{
	meta:
		author = "Marc Salinas @Bondey_m"
		description = "APT28 downdelph magic string"
		reference = "https://www.threatminer.org/_reports/2016/eset-sednit-part3%20-%20ESET.pdf#viewer.action=download"
	strings:
		$str1 = " :3 "
	condition:
		$str1 at 0
}
YARA Detection Rule: APT_fancybear_Downdelph_MBR
Repository: Yara-Rules/rules
Detects: APT28 downdelph string on MBR (get your MBR with BOOTICE on Win or #dd if=/dev/sda of=./sda.mbr bs=512 count=1
Author: Marc Salinas @Bondey_m
Reference: https://www.threatminer.org/_reports/2016/eset-sednit-part3%20-%20ESET.pdf#viewer.action=download

Pattern signatures:
$s1 = { 20 3A 33 20 } //string " :3 "

Detection condition:
$s1 at 411  //posición 0x19b

Full rule:
rule APT_fancybear_Downdelph_MBR : Bootkit{
	meta:
		author = "Marc Salinas @Bondey_m"
		description = "APT28 downdelph string on MBR (get your MBR with BOOTICE on Win or #dd if=/dev/sda of=./sda.mbr bs=512 count=1"
		reference = "https://www.threatminer.org/_reports/2016/eset-sednit-part3%20-%20ESET.pdf#viewer.action=download"
	strings:
		$s1 = { 20 3A 33 20 } //string " :3 "
	condition:
		$s1 at 411  //posición 0x19b
}
YARA Detection Rule: PubSabCode
Repository: Yara-Rules/rules
Detects: PubSab code tricks
Author: Seth Hardy

Pattern signatures:
$decrypt = { 6B 45 E4 37 89 CA 29 C2 89 55 E4 }

Detection condition:
any of them

Full rule:
rule PubSabCode : PubSab Family 
{
    meta:
        description = "PubSab code tricks"
        author = "Seth Hardy"
        last_modified = "2014-06-19"
        
    strings:
        $decrypt = { 6B 45 E4 37 89 CA 29 C2 89 55 E4 }
        
    condition:
        any of them
}
YARA Detection Rule: PubSabStrings
Repository: Yara-Rules/rules
Detects: PubSab Identifying Strings
Author: Seth Hardy

Pattern signatures:
$ = "_deamon_init"
        $ = "com.apple.PubSabAgent"
        $ = "/tmp/screen.jpeg"

Detection condition:
any of them

Full rule:
rule PubSabStrings : PubSab Family
{
    meta:
        description = "PubSab Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-06-19"
        
    strings:
        $ = "_deamon_init"
        $ = "com.apple.PubSabAgent"
        $ = "/tmp/screen.jpeg"
       
    condition:
        any of them
}
YARA Detection Rule: PubSab
Repository: Yara-Rules/rules
Detects: PubSab
Author: Seth Hardy

Detection condition:
PubSabCode or PubSabStrings

Full rule:
rule PubSab : Family
{
    meta:
        description = "PubSab"
        author = "Seth Hardy"
        last_modified = "2014-06-19"
        
    condition:
        PubSabCode or PubSabStrings
}
YARA Detection Rule: IotReaper
Repository: Yara-Rules/rules
Detects: Linux.IotReaper
Author: Joan Soriano / @w0lfvan

Pattern signatures:
$a = "weruuoqweiur.com"
		$b = "rm -f /tmp/ftpupload.sh \n"
		$c = "%02x-%02x-%02x-%02x-%02x-%02x"

Detection condition:
all of them

Full rule:
rule IotReaper: MALW
{
	meta:
		description = "Linux.IotReaper"
		author = "Joan Soriano / @w0lfvan"
		date = "2017-10-30"
		version = "1.0"
		MD5 = "95b448bdf6b6c97a33e1d1dbe41678eb"
		SHA256 = "b463ca6c3ec7fa19cd318afdd2fa2365fa9e947771c21c4bd6a3bc2120ba7f28"
	strings:
		$a = "weruuoqweiur.com"
		$b = "rm -f /tmp/ftpupload.sh \n"
		$c = "%02x-%02x-%02x-%02x-%02x-%02x"
	condition:
		all of them
}
YARA Detection Rule: is__str_mandibule_gen1
Repository: Yara-Rules/rules
Author: unixfreaxjp

Pattern signatures:
$str01 = "shared arguments too big" fullword nocase wide ascii
		$str02 = "self inject pid: %" fullword nocase wide ascii
		$str03 = "injected shellcode at 0x%lx" fullword nocase wide ascii        	
		$str04 = "target pid: %d" fullword nocase wide ascii        	
		$str05 = "mapping '%s' into memory at 0x%lx" fullword nocase wide ascii
		$str06 = "shellcode injection addr: 0x%lx" fullword nocase wide ascii
		$str07 = "loading elf at: 0x%llx" fullword nocase wide ascii

Detection condition:
4 of them

Full rule:
private rule is__str_mandibule_gen1 {
	meta:
		author = "unixfreaxjp"
		date = "2018-05-31"
	strings:
		$str01 = "shared arguments too big" fullword nocase wide ascii
		$str02 = "self inject pid: %" fullword nocase wide ascii
		$str03 = "injected shellcode at 0x%lx" fullword nocase wide ascii        	
		$str04 = "target pid: %d" fullword nocase wide ascii        	
		$str05 = "mapping '%s' into memory at 0x%lx" fullword nocase wide ascii
		$str06 = "shellcode injection addr: 0x%lx" fullword nocase wide ascii
		$str07 = "loading elf at: 0x%llx" fullword nocase wide ascii
	condition:
                4 of them
}
YARA Detection Rule: is__hex_top_mandibule64
Repository: Yara-Rules/rules
Author: unixfreaxjp

Pattern signatures:
$hex01 = { 48 8D 05 43 01 00 00 48 89 E7 FF D0 } // st
		$hex02 = { 53 48 83 EC 50 48 89 7C 24 08 48 8B 44 24 08 } // mn
		$hex03 = { 48 81 EC 18 02 00 00 89 7C 24 1C 48 89 74 } // pt
		$hex04 = { 53 48 81 EC 70 01 01 00 48 89 7C 24 08 48 8D 44 24 20 48 05 00 00 } // ld

Detection condition:
3 of them

Full rule:
private rule is__hex_top_mandibule64 {
	meta:
		author = "unixfreaxjp"
		date = "2018-05-31"
	strings:
		$hex01 = { 48 8D 05 43 01 00 00 48 89 E7 FF D0 } // st
		$hex02 = { 53 48 83 EC 50 48 89 7C 24 08 48 8B 44 24 08 } // mn
		$hex03 = { 48 81 EC 18 02 00 00 89 7C 24 1C 48 89 74 } // pt
		$hex04 = { 53 48 81 EC 70 01 01 00 48 89 7C 24 08 48 8D 44 24 20 48 05 00 00 } // ld
	condition:
                3 of them 
}