deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: MAL_Chrysalis_Backdoor_Feb26
Repository: Neo23x0/signature-base
Detects: Detects Chrysalis backdoor, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT group Lotus Blossom
Author: X__Junior
Reference: https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/

Pattern signatures:
$opa1 = { 8B 4D ?? C1 CF ?? C1 C1 ?? 03 F9 D1 C3 8B 4D ?? C1 C1 ?? 03 F9 03 FB 8B 5D ?? 69 CF ?? ?? ?? ?? BF ?? ?? ?? ?? 2B F9 EB }
      $opa2 = { F7 E9 [0-1] 8B C2 C1 E8 ?? 03 C2 8D 0C 40 8A C3 34 ?? [0-2] 0F B6 [1-4] 0F B6 C3 8B 5D [1-3] 0F 45 D0 }

      $opb1 = { 0F B6 84 35 ?? ?? ?? ?? 88 84 3D ?? ?? ?? ?? 88 8C 35 ?? ?? ?? ?? 0F B6 84 3D ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 03 C2 0F B6 C0 0F B6 84 05 ?? ?? ?? ?? 30 04 19 43 3B 9D ?? ?? ?? ?? 7C }

Detection condition:
(1 of ($opa*) and $opb1)
      or
      all of ($opa*)

Full rule:
rule MAL_Chrysalis_Backdoor_Feb26 {
   meta:
      description = "Detects Chrysalis backdoor, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT group Lotus Blossom"
      author = "X__Junior"
      date = "2026-02-02"
      reference = "https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/"
      hash = "e2e3d78437cf9d48c2b2264e44bb36bc2235834fc45bbb50b5d6867f336711e3"
      score = 80
   strings:
      $opa1 = { 8B 4D ?? C1 CF ?? C1 C1 ?? 03 F9 D1 C3 8B 4D ?? C1 C1 ?? 03 F9 03 FB 8B 5D ?? 69 CF ?? ?? ?? ?? BF ?? ?? ?? ?? 2B F9 EB }
      $opa2 = { F7 E9 [0-1] 8B C2 C1 E8 ?? 03 C2 8D 0C 40 8A C3 34 ?? [0-2] 0F B6 [1-4] 0F B6 C3 8B 5D [1-3] 0F 45 D0 }

      $opb1 = { 0F B6 84 35 ?? ?? ?? ?? 88 84 3D ?? ?? ?? ?? 88 8C 35 ?? ?? ?? ?? 0F B6 84 3D ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 03 C2 0F B6 C0 0F B6 84 05 ?? ?? ?? ?? 30 04 19 43 3B 9D ?? ?? ?? ?? 7C }
   condition:
      (1 of ($opa*) and $opb1)
      or
      all of ($opa*)
}
YARA Detection Rule: MAL_CobaltStrike_Beacon_Loader_Feb26
Repository: Neo23x0/signature-base
Detects: Detects Cobalt Strike beacon loader
Author: X__Junior
Reference: https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/

Pattern signatures:
$opa1 = { 45 33 C9 41 B8 ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 66 89 44 24 ?? 41 B8 ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? 0F B7 4C 24 ?? FF 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? FF 15 }
      $opa2 = { 4C 8D 4C 24 ?? 41 B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 48 89 4C 24 ?? 4C 8D 0D ?? ?? ?? ?? 45 33 C0 33 D2 48 8B C8 FF 15 }

      $opb1 = { 48 8D 89 ?? ?? ?? ?? 0F 10 00 0F 10 48 ?? 48 8D 80 ?? ?? ?? ?? 0F 11 41 ?? 0F 10 40 ?? 0F 11 49 ?? 0F 10 48 ?? 0F 11 41 ?? 0F 10 40 ?? 0F 11 49 ?? 0F 10 48 ?? 0F 11 41 ?? 0F 10 40 ?? 0F 11 49 ?? 0F 10 48 ?? 0F 11 41 ?? 0F 11 49 ?? 48 83 EA }
      $opb2 = { 45 33 C9 48 89 84 24 ?? ?? ?? ?? 41 B8 18 00 00 00 C7 84 24 ?? ?? ?? ?? 03 00 00 00 48 8D 94 24 ?? ?? ?? ?? 48 89 BC 24 ?? ?? ?? ?? B9 B9 00 00 00 FF 15 }

Detection condition:
uint16(0) == 0x5a4d and
      all of ($opa*)
      or all of ($opb*)

Full rule:
rule MAL_CobaltStrike_Beacon_Loader_Feb26 {
   meta:
      description = "Detects Cobalt Strike beacon loader"
      author = "X__Junior"
      date = "2026-02-02"
      reference = "https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/"
      hash = "0a9b8df968df41920b6ff07785cbfebe8bda29e6b512c94a3b2a83d10014d2fd"
      hash = "b4169a831292e245ebdffedd5820584d73b129411546e7d3eccf4663d5fc5be3"
      score = 80
   strings:
      $opa1 = { 45 33 C9 41 B8 ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 66 89 44 24 ?? 41 B8 ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? 0F B7 4C 24 ?? FF 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? FF 15 }
      $opa2 = { 4C 8D 4C 24 ?? 41 B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 48 89 4C 24 ?? 4C 8D 0D ?? ?? ?? ?? 45 33 C0 33 D2 48 8B C8 FF 15 }

      $opb1 = { 48 8D 89 ?? ?? ?? ?? 0F 10 00 0F 10 48 ?? 48 8D 80 ?? ?? ?? ?? 0F 11 41 ?? 0F 10 40 ?? 0F 11 49 ?? 0F 10 48 ?? 0F 11 41 ?? 0F 10 40 ?? 0F 11 49 ?? 0F 10 48 ?? 0F 11 41 ?? 0F 10 40 ?? 0F 11 49 ?? 0F 10 48 ?? 0F 11 41 ?? 0F 11 49 ?? 48 83 EA }
      $opb2 = { 45 33 C9 48 89 84 24 ?? ?? ?? ?? 41 B8 18 00 00 00 C7 84 24 ?? ?? ?? ?? 03 00 00 00 48 8D 94 24 ?? ?? ?? ?? 48 89 BC 24 ?? ?? ?? ?? B9 B9 00 00 00 FF 15 }
   condition:
      uint16(0) == 0x5a4d and
      all of ($opa*)
      or all of ($opb*)
}
YARA Detection Rule: MAL_POC_Microsoft_Warbird_Loader_Feb26
Repository: Neo23x0/signature-base
Detects: Detects a POC to turn Microsoft Warbird into a shellcode loader
Author: X__Junior
Reference: https://cirosec.de/en/news/abusing-microsoft-warbird-for-shellcode-execution/

Pattern signatures:
$op = { fe af fe ca ef be ad de }

Detection condition:
uint16(0) == 0x5a4d and $op

Full rule:
rule MAL_POC_Microsoft_Warbird_Loader_Feb26 {
   meta:
      description = "Detects a POC to turn Microsoft Warbird into a shellcode loader"
      author = "X__Junior"
      date = "2026-02-03"
      reference = "https://cirosec.de/en/news/abusing-microsoft-warbird-for-shellcode-execution/"
      hash = "29d0467ee[PII_REDACTED]18f350ceb28a2b04ee4c6de550ba0edc34ae0fa7cbb03"
      score = 75
   strings:
      $op = { fe af fe ca ef be ad de }
   condition:
      uint16(0) == 0x5a4d and $op
}
YARA Detection Rule: LOG_EXPL_ProxyToken_Exploitation_Aug21_1
Repository: Neo23x0/signature-base
Detects: Detects ProxyToken CVE-2021-33766 exploitation attempts on an unpatched system
Author: Florian Roth (Nextron Systems)
Reference: https://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server

Pattern signatures:
$ss0 = "POST " ascii
      $ss1 = " 500 0 0"

      $sa1 = "/ecp/" ascii
      $sa2 = "/RulesEditor/InboxRules.svc/NewObject" ascii

      $sb1 = "/ecp/" ascii
      $sb2 = "SecurityToken=" ascii

Detection condition:
all of ($ss*) and ( all of ($sa*) or all of ($sb*) )

Full rule:
rule LOG_EXPL_ProxyToken_Exploitation_Aug21_1 {
   meta:
      description = "Detects ProxyToken CVE-2021-33766 exploitation attempts on an unpatched system"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server"
      date = "2021-08-30"
      score = 75
      id = "f4840140-6d31-52f9-b1a0-2acdd4b955cd"
   strings:
      $ss0 = "POST " ascii
      $ss1 = " 500 0 0"

      $sa1 = "/ecp/" ascii
      $sa2 = "/RulesEditor/InboxRules.svc/NewObject" ascii

      $sb1 = "/ecp/" ascii
      $sb2 = "SecurityToken=" ascii
   condition:
      all of ($ss*) and ( all of ($sa*) or all of ($sb*) )
}
YARA Detection Rule: SUSP_INDICATOR_RTF_MalVer_Objects
Repository: Neo23x0/signature-base
Detects: Detects RTF documents with non-standard version and embedding one of the object mostly observed in exploit (e.g. CVE-2017-11882) documents.
Author: ditekSHen
Reference: https://github.com/ditekshen/detection

Pattern signatures:
// Embedded Objects
      $obj1 = "\\objhtml" ascii
      $obj2 = "\\objdata" ascii
      $obj3 = "\\objupdate" ascii
      $obj4 = "\\objemb" ascii
      $obj5 = "\\objautlink" ascii
      $obj6 = "\\objlink" ascii

Detection condition:
uint32(0) == 0x74725c7b and (
         // missing 'f' after '{\rt' and missing '1' (version) after 'rtf' and no char-set set ('\' missing at pos 6)
         // https://www.biblioscape.com/rtf15_spec.htm#Heading6
         (not uint8(4) == 0x66 or not uint8(5) == 0x31 or not uint8(6) == 0x5c) 
       

Full rule:
rule SUSP_INDICATOR_RTF_MalVer_Objects { //phns[PII_REDACTED]
   meta:
      description = "Detects RTF documents with non-standard version and embedding one of the object mostly observed in exploit (e.g. CVE-2017-11882) documents."
      author = "ditekSHen"
      reference = "https://github.com/ditekshen/detection"
      date = "2022-10-20"
      score = 65
      hash1 = "43812ca7f583e40b3e3e92ae90a7e935c87108fa863702aa9623c6b7dc3697a2"
      hash2 = "a31da6c6a8a340901f764586a28bd5f11f6d2a60a38bf60acd844c906a0d44b1"
      id = "2d9d80e0-473e-5aac-a576-8f0002e120e2"
   strings:
      // Embedded Objects
      $obj1 = "\\objhtml" ascii
      $obj2 = "\\objdata" ascii
      $obj3 = "\\objupdate" ascii
      $obj4 = "\\objemb" ascii
      $obj5 = "\\objautlink" ascii
      $obj6 = "\\objlink" ascii
   condition:
      uint32(0) == 0x74725c7b and (
         // missing 'f' after '{\rt' and missing '1' (version) after 'rtf' and no char-set set ('\' missing at pos 6)
         // https://www.biblioscape.com/rtf15_spec.htm#Heading6
         (not uint8(4) == 0x66 or not uint8(5) == 0x31 or not uint8(6) == 0x5c) 
         and 1 of ($obj*)
      )
}
YARA Detection Rule: crime_win64_backdoor_bazarbackdoor1
Repository: Neo23x0/signature-base
Detects: Detects BazarBackdoor injected 64-bit malware
Author: @VK_Intel
Reference: https://twitter.com/pancak3lullz/status/[PII_REDACTED]47565057

Pattern signatures:
$str1 = "%id%"
        /* $str2 = "%d" // disabled due to performance concerns */ 

        $start = { 48 ?? ?? ?? ?? 57 48 83 ec 30 b9 01 00 00 00 e8 ?? ?? ?? ?? 84 c0 0f ?? ?? ?? ?? ?? 40 32 ff 40 ?? ?? ?? ?? e8 ?? ?? ?? ?? 8a d8 8b ?? ?? ?? ?? ?? 83 f9 01 0f ?? ?? ?? ?? ?? 85 c9 75 ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 85 c0 74 ?? b8 ff 00 00 00 e9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? eb ?? 40 b7 01 40 ?? ?? ?? ?? 8a cb e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? 48 8b d8 48 ?? ?? ?? 74 ??}
        $server = {40 53 48 83 ec 20 48 8b d9 e8 ?? ?? ?? ?? 85 c0 75 ?? 0f ?? ?? ?? ?? ?? ?? 66 83 f8 50 74 ?? b9 bb 01 00 00 66 3b c1 74 ?? a8 01 74 ?? 48 8b cb e8 ?? ?? ?? ?? 84 c0 75 ?? 48 8b cb e8 ?? ?? ?? ?? b8 f6 ff ff ff eb ?? 33 c0 48 83 c4 20 5b c3}

Detection condition:
//( uint16(0) == 0x5a4d and ( 3 of them ) ) or ( all of them )
        uint16(0) == 0x5a4d and all of them

Full rule:
rule crime_win64_backdoor_bazarbackdoor1 {
    meta:
        description = "Detects BazarBackdoor injected 64-bit malware"
        author = "@VK_Intel"
        reference = "https://twitter.com/pancak3lullz/status/[PII_REDACTED]47565057"
        tlp = "white"
        date = "2020-04-24"
        id = "1e387791-97fa-527d-87ed-68872b1891c4"
    strings:
        $str1 = "%id%"
        /* $str2 = "%d" // disabled due to performance concerns */ 

        $start = { 48 ?? ?? ?? ?? 57 48 83 ec 30 b9 01 00 00 00 e8 ?? ?? ?? ?? 84 c0 0f ?? ?? ?? ?? ?? 40 32 ff 40 ?? ?? ?? ?? e8 ?? ?? ?? ?? 8a d8 8b ?? ?? ?? ?? ?? 83 f9 01 0f ?? ?? ?? ?? ?? 85 c9 75 ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 85 c0 74 ?? b8 ff 00 00 00 e9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? eb ?? 40 b7 01 40 ?? ?? ?? ?? 8a cb e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? 48 8b d8 48 ?? ?? ?? 74 ??}
        $server = {40 53 48 83 ec 20 48 8b d9 e8 ?? ?? ?? ?? 85 c0 75 ?? 0f ?? ?? ?? ?? ?? ?? 66 83 f8 50 74 ?? b9 bb 01 00 00 66 3b c1 74 ?? a8 01 74 ?? 48 8b cb e8 ?? ?? ?? ?? 84 c0 75 ?? 48 8b cb e8 ?? ?? ?? ?? b8 f6 ff ff ff eb ?? 33 c0 48 83 c4 20 5b c3}
    condition:
        //( uint16(0) == 0x5a4d and ( 3 of them ) ) or ( all of them )
        uint16(0) == 0x5a4d and all of them
}
YARA Detection Rule: Mimipenguin_SH
Repository: Neo23x0/signature-base
Detects: Detects Mimipenguin Password Extractor - Linux
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/huntergregal/mimipenguin

Pattern signatures:
$s1 = "$(echo $thishash | cut -d'$' -f 3)" ascii
      $s2 = "ps -eo pid,command | sed -rn '/gnome\\-keyring\\-daemon/p' | awk" ascii
      $s3 = "MimiPenguin Results:" ascii

Detection condition:
1 of them

Full rule:
rule Mimipenguin_SH {
   meta:
      description = "Detects Mimipenguin Password Extractor - Linux"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/huntergregal/mimipenguin"
      date = "2017-04-01"
      id = "c670f6fe-562d-598f-a73f-45e4ab234f7d"
   strings:
      $s1 = "$(echo $thishash | cut -d'$' -f 3)" ascii
      $s2 = "ps -eo pid,command | sed -rn '/gnome\\-keyring\\-daemon/p' | awk" ascii
      $s3 = "MimiPenguin Results:" ascii
   condition:
      1 of them
}
YARA Detection Rule: mimipenguin_1
Repository: Neo23x0/signature-base
Detects: Detects Mimipenguin hack tool
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/huntergregal/mimipenguin

Pattern signatures:
$x1 = "self._strings_dump += strings(dump_process(target_pid))" fullword ascii
      $x2 = "def _dump_target_processes(self):" fullword ascii
      $x3 = "self._target_processes = ['sshd:']" fullword ascii
      $x4 = "GnomeKeyringPasswordFinder()" ascii

Detection condition:
( uint16(0) == 0x2123 and filesize < 20KB and 1 of them )

Full rule:
rule mimipenguin_1 {
   meta:
      description = "Detects Mimipenguin hack tool"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/huntergregal/mimipenguin"
      date = "2017-07-08"
      hash1 = "9e8d13fe27c93c7571075abf84a839fd1d31d8f2e3e48b3f4c6c13f7afcf8cbd"
      id = "62754337-52ef-5d3f-af2f-52f820ba0476"
   strings:
      $x1 = "self._strings_dump += strings(dump_process(target_pid))" fullword ascii
      $x2 = "def _dump_target_processes(self):" fullword ascii
      $x3 = "self._target_processes = ['sshd:']" fullword ascii
      $x4 = "GnomeKeyringPasswordFinder()" ascii
   condition:
      ( uint16(0) == 0x2123 and filesize < 20KB and 1 of them )
}
YARA Detection Rule: mimipenguin_2
Repository: Neo23x0/signature-base
Detects: Detects Mimipenguin hack tool
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/huntergregal/mimipenguin

Pattern signatures:
$x1 = "DUMP=$(strings \"/tmp/dump.${pid}\" | grep -E" fullword ascii
      $x2 = "strings /tmp/apache* | grep -E '^Authorization: Basic.+=$'" fullword ascii
      $x3 = "grep -E '^_pammodutil_getpwnam_root_1$' -B 5 -A" fullword ascii
      $x4 = "strings \"/tmp/dump.${pid}\" | grep -E -m 1 '^\\$.\\$.+\\$')\"" fullword ascii
      $x5 = "if [[ -n $(ps -eo pid,command | grep -v 'grep' | grep gnome-keyring) ]]; then" fullword ascii

Detection condition:
( uint16(0) == 0x2123 and filesize < 20KB and 1 of them )

Full rule:
rule mimipenguin_2 {
   meta:
      description = "Detects Mimipenguin hack tool"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/huntergregal/mimipenguin"
      date = "2017-07-08"
      hash1 = "453bffa90d99a820e4235de95ec3f7cc750539e4023f98ffc8858f9b3c15d89a"
      id = "b3bb1ba9-cbfc-53fd-81d0-256466ace4de"
   strings:
      $x1 = "DUMP=$(strings \"/tmp/dump.${pid}\" | grep -E" fullword ascii
      $x2 = "strings /tmp/apache* | grep -E '^Authorization: Basic.+=$'" fullword ascii
      $x3 = "grep -E '^_pammodutil_getpwnam_root_1$' -B 5 -A" fullword ascii
      $x4 = "strings \"/tmp/dump.${pid}\" | grep -E -m 1 '^\\$.\\$.+\\$')\"" fullword ascii
      $x5 = "if [[ -n $(ps -eo pid,command | grep -v 'grep' | grep gnome-keyring) ]]; then" fullword ascii
   condition:
      ( uint16(0) == 0x2123 and filesize < 20KB and 1 of them )
}
YARA Detection Rule: Empire_Invoke_MetasploitPayload
Repository: Neo23x0/signature-base
Detects: Detects Empire component - file Invoke-MetasploitPayload.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$s1 = "$ProcessInfo.Arguments=\"-nop -c $DownloadCradle\"" fullword ascii
      $s2 = "$PowershellExe=$env:windir+'\\syswow64\\WindowsPowerShell\\v1.0\\powershell.exe'" fullword ascii

Detection condition:
( uint16(0) == 0x7566 and filesize < 9KB and 1 of them ) or all of them

Full rule:
rule Empire_Invoke_MetasploitPayload {
   meta:
      description = "Detects Empire component - file Invoke-MetasploitPayload.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "a85ca27537ebeb79601b885b35ddff6431860b5852c6a664d32a321782808c54"
      id = "608c30b0-826a-55b1-afb8-756b476d6b55"
   strings:
      $s1 = "$ProcessInfo.Arguments=\"-nop -c $DownloadCradle\"" fullword ascii
      $s2 = "$PowershellExe=$env:windir+'\\syswow64\\WindowsPowerShell\\v1.0\\powershell.exe'" fullword ascii
   condition:
      ( uint16(0) == 0x7566 and filesize < 9KB and 1 of them ) or all of them
}
YARA Detection Rule: Empire_Exploit_Jenkins
Repository: Neo23x0/signature-base
Detects: Detects Empire component - file Exploit-Jenkins.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$s1 = "$postdata=\"script=println+new+ProcessBuilder%28%27\"+$($Cmd)+\"" ascii
      $s2 = "$url = \"http://\"+$($Rhost)+\":\"+$($Port)+\"/script\"" fullword ascii
      $s3 = "$Cmd = [System.Web.HttpUtility]::UrlEncode($Cmd)" fullword ascii

Detection condition:
( uint16(0) == 0x6620 and filesize < 7KB and 1 of them ) or all of them

Full rule:
rule Empire_Exploit_Jenkins {
   meta:
      description = "Detects Empire component - file Exploit-Jenkins.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "a5182cccd82bb9984b804b365e07baba78344108f225b94bd12a59081f680729"
      id = "f2162783-34cd-5db4-bd1c-6c58feb92e77"
   strings:
      $s1 = "$postdata=\"script=println+new+ProcessBuilder%28%27\"+$($Cmd)+\"" ascii
      $s2 = "$url = \"http://\"+$($Rhost)+\":\"+$($Port)+\"/script\"" fullword ascii
      $s3 = "$Cmd = [System.Web.HttpUtility]::UrlEncode($Cmd)" fullword ascii
   condition:
      ( uint16(0) == 0x6620 and filesize < 7KB and 1 of them ) or all of them
}
YARA Detection Rule: Empire_Get_SecurityPackages
Repository: Neo23x0/signature-base
Detects: Detects Empire component - file Get-SecurityPackages.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$s1 = "$null = $EnumBuilder.DefineLiteral('LOGON', 0x2000)" fullword ascii
      $s2 = "$EnumBuilder = $ModuleBuilder.DefineEnum('SSPI.SECPKG_FLAG', 'Public', [Int32])" fullword ascii

Detection condition:
( uint16(0) == 0x7566 and filesize < 20KB and 1 of them ) or all of them

Full rule:
rule Empire_Get_SecurityPackages {
   meta:
      description = "Detects Empire component - file Get-SecurityPackages.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "5d06e99121cff9b0fce74b71a137501452eebbcd1e901b26bde858313ee5a9c1"
      id = "a109eda1-a26d-5cf6-b6b5-1a1a1e770a0a"
   strings:
      $s1 = "$null = $EnumBuilder.DefineLiteral('LOGON', 0x2000)" fullword ascii
      $s2 = "$EnumBuilder = $ModuleBuilder.DefineEnum('SSPI.SECPKG_FLAG', 'Public', [Int32])" fullword ascii
   condition:
      ( uint16(0) == 0x7566 and filesize < 20KB and 1 of them ) or all of them
}
YARA Detection Rule: Empire_Invoke_PowerDump
Repository: Neo23x0/signature-base
Detects: Detects Empire component - file Invoke-PowerDump.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$x16 = "$enc = Get-PostHashdumpScript" fullword ascii
      $x19 = "$lmhash = DecryptSingleHash $rid $hbootkey $enc_lm_hash $almpassword;" fullword ascii
      $x20 = "$rc4_key = $md5.ComputeHash($hbootkey[0..0x0f] + [BitConverter]::GetBytes($rid) + $lmntstr);" fullword ascii

Detection condition:
( uint16(0) == 0x2023 and filesize < 60KB and 1 of them ) or all of them

Full rule:
rule Empire_Invoke_PowerDump {
   meta:
      description = "Detects Empire component - file Invoke-PowerDump.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "095c5cf5c0c8a9f9b1083302e2ba1d4e112a410e186670f9b089081113f5e0e1"
      id = "d1082a4e-d458-57fb-b332-7c775c8ef2dd"
   strings:
      $x16 = "$enc = Get-PostHashdumpScript" fullword ascii
      $x19 = "$lmhash = DecryptSingleHash $rid $hbootkey $enc_lm_hash $almpassword;" fullword ascii
      $x20 = "$rc4_key = $md5.ComputeHash($hbootkey[0..0x0f] + [BitConverter]::GetBytes($rid) + $lmntstr);" fullword ascii
   condition:
      ( uint16(0) == 0x2023 and filesize < 60KB and 1 of them ) or all of them
}
YARA Detection Rule: Empire_Install_SSP
Repository: Neo23x0/signature-base
Detects: Detects Empire component - file Install-SSP.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$s1 = "Install-SSP -Path .\\mimilib.dll" fullword ascii

Detection condition:
( uint16(0) == 0x7566 and filesize < 20KB and 1 of them ) or all of them

Full rule:
rule Empire_Install_SSP {
   meta:
      description = "Detects Empire component - file Install-SSP.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "7fd921a[PII_REDACTED]7dda57b99e03c1e1594d736aab2dbfe9583f99cd9b1d165"
      id = "06bbdcc5-c48b-5753-88a2-5c962d1b986f"
   strings:
      $s1 = "Install-SSP -Path .\\mimilib.dll" fullword ascii
   condition:
      ( uint16(0) == 0x7566 and filesize < 20KB and 1 of them ) or all of them
}
YARA Detection Rule: Empire_Invoke_ShellcodeMSIL
Repository: Neo23x0/signature-base
Detects: Detects Empire component - file Invoke-ShellcodeMSIL.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$s1 = "$FinalShellcode.Length" fullword ascii
      $s2 = "@(0x60,0xE8,0x04,0,0,0,0x61,0x31,0xC0,0xC3)" fullword ascii
      $s3 = "@(0x41,0x54,0x41,0x55,0x41,0x56,0x41,0x57," fullword ascii
      $s4 = "$TargetMethod.Invoke($null, @(0x11112222)) | Out-Null" fullword ascii

Detection condition:
( uint16(0) == 0x7566 and filesize < 30KB and 1 of them ) or all of them

Full rule:
rule Empire_Invoke_ShellcodeMSIL {
   meta:
      description = "Detects Empire component - file Invoke-ShellcodeMSIL.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "9a9c6c9eb67bde4a8ce2c0858e353e19627b17ee2a7215fa04a19010d3ef153f"
      id = "06011b51-bad7-5656-ac37-e49f9b6d0498"
   strings:
      $s1 = "$FinalShellcode.Length" fullword ascii
      $s2 = "@(0x60,0xE8,0x04,0,0,0,0x61,0x31,0xC0,0xC3)" fullword ascii
      $s3 = "@(0x41,0x54,0x41,0x55,0x41,0x56,0x41,0x57," fullword ascii
      $s4 = "$TargetMethod.Invoke($null, @(0x11112222)) | Out-Null" fullword ascii
   condition:
      ( uint16(0) == 0x7566 and filesize < 30KB and 1 of them ) or all of them
}