deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: RUAG_APT_Malware_Gen2
Repository: Neo23x0/signature-base
Detects: Detects malware used in the RUAG APT case
Author: Florian Roth (Nextron Systems)
Reference: https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case

Pattern signatures:
$x1 = "Internal command not support =((" ascii
      $x2 = "L|-1|AS_CUR_USER:OpenProcessToken():%d, %s|" fullword ascii
      $x3 = "L|-1|CreateProcessAsUser():%d, %s|" fullword ascii
      $x4 = "AS_CUR_USER:OpenProcessToken():%d" fullword ascii
      $x5 = "L|-1|AS_CUR_USER:LogonUser():%d, %s|" fullword ascii
      $x6 = "L|-1|try to run dll %s with user priv|" fullword ascii
      $x7 = "\\\\.\\Global\\PIPE\\sdlrpc" fullword ascii
      $x8 = "\\\\%s\\pipe\\comnode" fullword ascii
      $x9 = "Plugin dll stop failed." fullword ascii
      $x10 = "AS_USER:LogonUser():%d" fullword ascii

      $s1 = "MSIMGHLP.DLL" fullword wide
      $s2 = "msimghlp.dll" fullword ascii
      $s3 = "ximarsh.dll" fullword ascii
      $s4 = "msximl.dll" fullword ascii
      $s5 = "INTERNAL.dll" fullword ascii
      $s6 = "\\\\.\\Global\\PIPE\\" ascii
      $s7 = "ieuser.exe" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) or 5 of ($s*) ) )
      or ( 10 of them )

Full rule:
rule RUAG_APT_Malware_Gen2 {
   meta:
      description = "Detects malware used in the RUAG APT case"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
      date = "2016-06-09"
      modified = "2023-01-06"
      score = 90
      hash1 = "0e1bf347c37fb199886f1e675e372ba55ac4627e8be2f05a76c2c64f9b6ed0e4"
      hash2 = "7206075cd8f1004e8f1f759d46e98bfad4098b[PII_REDACTED]a214c0155a1f08b9"
      hash3 = "fe3ffd7438c0d38484bf02a78a19ea81a6f51b4b3f2b2228bd21974c2538bbcd"
      hash4 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
      id = "8a50e5d5-f16d-53c7-825c-a8e51c207eac"
   strings:
      $x1 = "Internal command not support =((" ascii
      $x2 = "L|-1|AS_CUR_USER:OpenProcessToken():%d, %s|" fullword ascii
      $x3 = "L|-1|CreateProcessAsUser():%d, %s|" fullword ascii
      $x4 = "AS_CUR_USER:OpenProcessToken():%d" fullword ascii
      $x5 = "L|-1|AS_CUR_USER:LogonUser():%d, %s|" fullword ascii
      $x6 = "L|-1|try to run dll %s with user priv|" fullword ascii
      $x7 = "\\\\.\\Global\\PIPE\\sdlrpc" fullword ascii
      $x8 = "\\\\%s\\pipe\\comnode" fullword ascii
      $x9 = "Plugin dll stop failed." fullword ascii
      $x10 = "AS_USER:LogonUser():%d" fullword ascii

      $s1 = "MSIMGHLP.DLL" fullword wide
      $s2 = "msimghlp.dll" fullword ascii
      $s3 = "ximarsh.dll" fullword ascii
      $s4 = "msximl.dll" fullword ascii
      $s5 = "INTERNAL.dll" fullword ascii
      $s6 = "\\\\.\\Global\\PIPE\\" ascii
      $s7 = "ieuser.exe" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) or 5 of ($s*) ) )
      or ( 10 of them )
}
YARA Detection Rule: Turla_Mal_Script_Jan18_1
Repository: Neo23x0/signature-base
Detects: Detects Turla malicious script
Author: Florian Roth (Nextron Systems)
Reference: https://ghostbin.com/paste/jsph7

Pattern signatures:
$s1 = ".charCodeAt(i % " ascii
      $s2 = "{WScript.Quit();}" fullword ascii
      $s3 = ".charAt(i)) << 10) |" ascii
      $s4 = " = WScript.Arguments;var " ascii
      $s5 = "= \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz[PII_REDACTED]+/\";var i;" ascii

Detection condition:
filesize < 200KB and 2 of them

Full rule:
rule Turla_Mal_Script_Jan18_1 {
   meta:
      description = "Detects Turla malicious script"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://ghostbin.com/paste/jsph7"
      date = "2018-01-19"
      hash1 = "180b920e9cea712d124ff41cd1060683a14a79285d960e17f0f49b969f15bfcc"
      id = "4b550b3c-182c-5dc0-b2d2-13925c22be81"
   strings:
      $s1 = ".charCodeAt(i % " ascii
      $s2 = "{WScript.Quit();}" fullword ascii
      $s3 = ".charAt(i)) << 10) |" ascii
      $s4 = " = WScript.Arguments;var " ascii
      $s5 = "= \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz[PII_REDACTED]+/\";var i;" ascii
   condition:
      filesize < 200KB and 2 of them
}
YARA Detection Rule: Turla_KazuarRAT
Repository: Neo23x0/signature-base
Detects: Detects Turla Kazuar RAT described by DrunkBinary
Author: Markus Neis / Florian Roth
Reference: https://twitter.com/DrunkBinary/status/[PII_REDACTED]75319553

Pattern signatures:
$x1 = "~1.EXE" wide
      $s2 = "dl32.dll" fullword ascii
      $s3 = "HookProc@" ascii
      $s4 = "0`.wtf" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and  filesize < 20KB and (
         pe.imphash() == "682156c4380c216ff8cb766a2f2e8817" or
         2 of them )

Full rule:
rule Turla_KazuarRAT {
   meta:
      description = "Detects Turla Kazuar RAT described by DrunkBinary"
      author = "Markus Neis / Florian Roth"
      reference = "https://twitter.com/DrunkBinary/status/[PII_REDACTED]75319553"
      date = "2018-04-08"
      hash1 = "6b5d9fca6f49a044fd94c816e258bf50b1e90305d7dab2e0480349e80ed2a0fa"
      hash2 = "7594fab1aadc4fb08fb9dbb27c418e8bc7f08dadb2acf5533dc8560241ecfc1d"
      hash3 = "4e5a86e33e53931afe25a8cb108f53f9c7e6c6a731b0ef4f72ce638d0ea5c198"
      id = "147cc7b7-6dbd-51a2-9501-bcbaec32e20e"
   strings:
      $x1 = "~1.EXE" wide
      $s2 = "dl32.dll" fullword ascii
      $s3 = "HookProc@" ascii
      $s4 = "0`.wtf" fullword ascii
   condition:
      uint16(0) == 0x5a4d and  filesize < 20KB and (
         pe.imphash() == "682156c4380c216ff8cb766a2f2e8817" or
         2 of them )
}
YARA Detection Rule: MAL_Turla_Agent_BTZ
Repository: Neo23x0/signature-base
Detects: Detects Turla Agent.BTZ
Author: Florian Roth (Nextron Systems)
Reference: https://www.gdatasoftware.com/blog/2014/11/23937-the-uroburos-case-new-sophisticated-rat-identified

Pattern signatures:
$x1 = "1dM3uu4j7Fw4sjnbcwlDqet4F7JyuUi4m5Imnxl1pzxI6as80cbLnmz54cs5Ldn4ri3do5L6gs923HL34x2f5cvd0fk6c1a0s" fullword ascii
      $x3 = "mstotreg.dat" fullword ascii
      $x4 = "Bisuninst.bin" fullword ascii
      $x5 = "mfc42l00.pdb" fullword ascii
      $x6 = "ielocal~f.tmp" fullword ascii

      $s1 = "%s\\1.txt" fullword ascii
      $s2 = "%windows%" fullword ascii
      $s3 = "%s\\system32" fullword ascii
      $s4 = "\\Help\\SYSTEM32\\" ascii
      $s5 = "%windows%\\mfc42l00.pdb" ascii
      $s6 = "Size of log(%dB) is too big, stop write." fullword ascii
      $s7 = "Log: Size of log(%dB) is too big, stop write." fullword ascii
      $s8 = "%02d.%02d.%04d Log begin:" fullword ascii
      $s9 = "\\system32\\win.com" ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and (
         1 of ($x*) or
         4 of them
      )

Full rule:
rule MAL_Turla_Agent_BTZ {
   meta:
      description = "Detects Turla Agent.BTZ"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.gdatasoftware.com/blog/2014/11/23937-the-uroburos-case-new-sophisticated-rat-identified"
      date = "2018-04-12"
      modified = "2023-01-06"
      score = 90
      hash1 = "c4a1cd6916646aa502413d42e6e7441c6e[PII_REDACTED]f19d9acbf5113fc52fc8"
      id = "bd642f11-19f6-5178-b[PII_REDACTED]fea86"
   strings:
      $x1 = "1dM3uu4j7Fw4sjnbcwlDqet4F7JyuUi4m5Imnxl1pzxI6as80cbLnmz54cs5Ldn4ri3do5L6gs923HL34x2f5cvd0fk6c1a0s" fullword ascii
      $x3 = "mstotreg.dat" fullword ascii
      $x4 = "Bisuninst.bin" fullword ascii
      $x5 = "mfc42l00.pdb" fullword ascii
      $x6 = "ielocal~f.tmp" fullword ascii

      $s1 = "%s\\1.txt" fullword ascii
      $s2 = "%windows%" fullword ascii
      $s3 = "%s\\system32" fullword ascii
      $s4 = "\\Help\\SYSTEM32\\" ascii
      $s5 = "%windows%\\mfc42l00.pdb" ascii
      $s6 = "Size of log(%dB) is too big, stop write." fullword ascii
      $s7 = "Log: Size of log(%dB) is too big, stop write." fullword ascii
      $s8 = "%02d.%02d.%04d Log begin:" fullword ascii
      $s9 = "\\system32\\win.com" ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 100KB and (
         1 of ($x*) or
         4 of them
      )
}
YARA Detection Rule: MAL_Turla_Sample_May18_1
Repository: Neo23x0/signature-base
Detects: Detects Turla samples
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/omri9741/status/[PII_REDACTED]01598208

Pattern signatures:
$x1 = "sc %s create %s binPath= \"cmd.exe /c start %%SystemRoot%%\\%s\">>%s" fullword ascii
      $x2 = "cmd.exe /c start %%SystemRoot%%\\%s" fullword ascii
      $x3 = "cmd.exe /c %s\\%s -s %s:%s:%s -c \"%s %s /wait 1\">>%s" fullword ascii
      $x4 = "Read InjectLog[%dB]********************************" fullword ascii
      $x5 = "%s\\System32\\011fe-3420f-ff0ea-ff0ea.tmp" fullword ascii
      $x6 = "**************************** Begin ini %s [%d]***********************************************" fullword ascii
      $x7 = "%s -o %s -i %s -d exec2 -f %s" fullword ascii
      $x8 = "Logon to %s failed: code %d(User:%s,Pass:%s)" fullword ascii
      $x9 = "system32\\dxsnd32x.exe" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and 1 of them

Full rule:
rule MAL_Turla_Sample_May18_1 {
   meta:
      description = "Detects Turla samples"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/omri9741/status/[PII_REDACTED]01598208"
      date = "2018-05-03"
      hash1 = "4c49c9d601ebf16534d24d2dd1cab53fde6e03902758ef6cff86be740b720038"
      hash2 = "77cbd7252a20f2d35db4f330b9c4b8aa7501349bc06bbcc8f40ae13d01ae7f8f"
      id = "5052838f-a895-55cb-abcf[PII_REDACTED]27"
   strings:
      $x1 = "sc %s create %s binPath= \"cmd.exe /c start %%SystemRoot%%\\%s\">>%s" fullword ascii
      $x2 = "cmd.exe /c start %%SystemRoot%%\\%s" fullword ascii
      $x3 = "cmd.exe /c %s\\%s -s %s:%s:%s -c \"%s %s /wait 1\">>%s" fullword ascii
      $x4 = "Read InjectLog[%dB]********************************" fullword ascii
      $x5 = "%s\\System32\\011fe-3420f-ff0ea-ff0ea.tmp" fullword ascii
      $x6 = "**************************** Begin ini %s [%d]***********************************************" fullword ascii
      $x7 = "%s -o %s -i %s -d exec2 -f %s" fullword ascii
      $x8 = "Logon to %s failed: code %d(User:%s,Pass:%s)" fullword ascii
      $x9 = "system32\\dxsnd32x.exe" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 500KB and 1 of them
}
YARA Detection Rule: APT_MAL_LNX_Turla_Apr20_1
Repository: Neo23x0/signature-base
Detects: Detects Turla Linux malware
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/Int2e_/status/[PII_REDACTED]31319309

Pattern signatures:
$s1 = "/root/.hsperfdata" ascii fullword
      $s2 = "Desc|     Filename     |  size  |state|" ascii fullword
      $s3 = "IPv6 address %s not supported" ascii fullword
      $s4 = "File already exist on remote filesystem !" ascii fullword
      $s5 = "/tmp/.sync.pid" ascii fullword
      $s6 = "'gateway' supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel" ascii fullword

Detection condition:
uint16(0) == 0x457f and
      filesize < 5000KB and
      4 of them

Full rule:
rule APT_MAL_LNX_Turla_Apr20_1 {
   meta:
      description = "Detects Turla Linux malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/Int2e_/status/[PII_REDACTED]31319309"
      date = "2020-04-05"
      hash1 = "67d9556c695ef6c51abf6fbab17acb3466e3149cf4d20cb64d6d34dc969b6502"
      hash2 = "8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc"
      id = "f21e7793-a7dd-5195-805d-963827b35808"
   strings:
      $s1 = "/root/.hsperfdata" ascii fullword
      $s2 = "Desc|     Filename     |  size  |state|" ascii fullword
      $s3 = "IPv6 address %s not supported" ascii fullword
      $s4 = "File already exist on remote filesystem !" ascii fullword
      $s5 = "/tmp/.sync.pid" ascii fullword
      $s6 = "'gateway' supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel" ascii fullword
   condition:
      uint16(0) == 0x457f and
      filesize < 5000KB and
      4 of them
}
YARA Detection Rule: APT_MAL_TinyTurla_Sep21_1
Repository: Neo23x0/signature-base
Detects: Detects Tiny Turla backdoor DLL
Author: Cisco Talos
Reference: https://blog.talosintelligence.com/2021/09/tinyturla.html

Pattern signatures:
$a = "Title: " fullword wide
		$b = "Hosts" fullword wide
		$c = "Security" fullword wide
		$d = "TimeLong" fullword wide
		$e = "TimeShort" fullword wide
		$f = "MachineGuid" fullword wide
		$g = "POST" fullword wide
		$h = "WinHttpSetOption" fullword ascii
		$i = "WinHttpQueryDataAvailable" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 25KB and all of them

Full rule:
rule APT_MAL_TinyTurla_Sep21_1 {
	meta:
		author = "Cisco Talos"
		description = "Detects Tiny Turla backdoor DLL"
		reference = "https://blog.talosintelligence.com/2021/09/tinyturla.html"
		hash1 = "030cbd1a51f8583ccfc3fa38a28a5550dc1c84c05d6c0f5eb887d13dedf1da01"
		date = "2021-09-21"
		id = "19659ac7-310a-52dd-a94c-022c7add752b"
	strings:
		$a = "Title: " fullword wide
		$b = "Hosts" fullword wide
		$c = "Security" fullword wide
		$d = "TimeLong" fullword wide
		$e = "TimeShort" fullword wide
		$f = "MachineGuid" fullword wide
		$g = "POST" fullword wide
		$h = "WinHttpSetOption" fullword ascii
		$i = "WinHttpQueryDataAvailable" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 25KB and all of them
}
YARA Detection Rule: LOG_TeamViewer_Connect_Chinese_Keyboard_Layout
Repository: Neo23x0/signature-base
Detects: Detects a suspicious TeamViewer log entry stating that the remote systems had a Chinese keyboard layout
Author: Florian Roth (Nextron Systems)
Reference: https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/default-input-locales-for-windows-language-packs

Pattern signatures:
/* Source has Chinese simplified keyboard layout */
      $x1 = "Changing keyboard layout to: 0804" ascii
      $x2 = "Changing keyboard layout to: 042a"
      /* Avoiding Chinese to Chinese support cases */
      $fp1 = "Changing keyboard layout to: 08040804" ascii
      $fp2 = "Changing keyboard layout to: 042a042a" ascii

Detection condition:
( #x1 + #x2 ) > ( #fp1 + #fp2 )

Full rule:
rule LOG_TeamViewer_Connect_Chinese_Keyboard_Layout {
   meta:
      description = "Detects a suspicious TeamViewer log entry stating that the remote systems had a Chinese keyboard layout"
      author = "Florian Roth (Nextron Systems)"
      date = "2019-10-12"
      modified = "2020-12-16"
      score = 60
      limit = "Logscan"
      reference = "https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/default-input-locales-for-windows-language-packs"
      id = "f901818b-5150-540f-b645-686c12784a38"
   strings:
      /* Source has Chinese simplified keyboard layout */
      $x1 = "Changing keyboard layout to: 0804" ascii
      $x2 = "Changing keyboard layout to: 042a"
      /* Avoiding Chinese to Chinese support cases */
      $fp1 = "Changing keyboard layout to: 08040804" ascii
      $fp2 = "Changing keyboard layout to: 042a042a" ascii
   condition:
      ( #x1 + #x2 ) > ( #fp1 + #fp2 )
}
YARA Detection Rule: LOG_TeamViewer_Connect_Russian_Keyboard_Layout
Repository: Neo23x0/signature-base
Detects: Detects a suspicious TeamViewer log entry stating that the remote systems had a Russian keyboard layout
Author: Florian Roth (Nextron Systems)
Reference: https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/default-input-locales-for-windows-language-packs

Pattern signatures:
/* Source has Russian keyboard layout */
      $x1 = "Changing keyboard layout to: 0419" ascii
      /* Avoiding Russian to Russian support cases */
      $fp1 = "Changing keyboard layout to: 04190419" ascii

Detection condition:
#x1 > #fp1

Full rule:
rule LOG_TeamViewer_Connect_Russian_Keyboard_Layout {
   meta:
      description = "Detects a suspicious TeamViewer log entry stating that the remote systems had a Russian keyboard layout"
      author = "Florian Roth (Nextron Systems)"
      date = "2019-10-12"
      modified = "2022-12-07"
      score = 60
      limit = "Logscan"
      reference = "https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/default-input-locales-for-windows-language-packs"
      id = "360a1cca-2a64-5fd8-bcde-f49e1b17281e"
   strings:
      /* Source has Russian keyboard layout */
      $x1 = "Changing keyboard layout to: 0419" ascii
      /* Avoiding Russian to Russian support cases */
      $fp1 = "Changing keyboard layout to: 04190419" ascii
   condition:
      #x1 > #fp1
}
YARA Detection Rule: CredentialStealer_Generic_Backdoor
Repository: Neo23x0/signature-base
Detects: Detects credential stealer byed on many strings that indicate password store access
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "GetOperaLoginData" fullword ascii
      $s2 = "GetInternetExplorerCredentialsPasswords" fullword ascii
      $s3 = "%s\\Opera Software\\Opera Stable\\Login Data" fullword ascii
      $s4 = "select *  from moz_logins" fullword ascii
      $s5 = "%s\\Google\\Chrome\\User Data\\Default\\Login Data" fullword ascii
      $s6 = "Host.dll.Windows" fullword ascii
      $s7 = "GetInternetExplorerVaultPasswords" fullword ascii
      $s8 = "GetWindowsLiveMessengerPasswords" fullword ascii
      $s9 = "%s\\Chromium\\User Data\\Default\\Login Data" fullword ascii
      $s10 = "%s\\Opera\\Opera\\profile\\wand.dat" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and 4 of them )

Full rule:
rule CredentialStealer_Generic_Backdoor {
   meta:
      description = "Detects credential stealer byed on many strings that indicate password store access"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-06-07"
      hash1 = "edb2d039a57181acf95bd91b2a20bd9f1d66f3ece18506d4ad870ab65e568f2c"
      id = "b3124f6c-4e18-562c-84d9-d51e086da446"
   strings:
      $s1 = "GetOperaLoginData" fullword ascii
      $s2 = "GetInternetExplorerCredentialsPasswords" fullword ascii
      $s3 = "%s\\Opera Software\\Opera Stable\\Login Data" fullword ascii
      $s4 = "select *  from moz_logins" fullword ascii
      $s5 = "%s\\Google\\Chrome\\User Data\\Default\\Login Data" fullword ascii
      $s6 = "Host.dll.Windows" fullword ascii
      $s7 = "GetInternetExplorerVaultPasswords" fullword ascii
      $s8 = "GetWindowsLiveMessengerPasswords" fullword ascii
      $s9 = "%s\\Chromium\\User Data\\Default\\Login Data" fullword ascii
      $s10 = "%s\\Opera\\Opera\\profile\\wand.dat" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and 4 of them )
}
YARA Detection Rule: MyWScript_CompiledScript
Repository: Neo23x0/signature-base
Detects: Detects a scripte with default name Mywscript compiled with Script2Exe (can also be a McAfee tool https://community.mcafee.com/docs/DOC-4124)
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "C:\\Projets\\vbsedit_source\\script2exe\\Release\\mywscript.pdb" fullword ascii
      $s1 = "mywscript2" fullword wide
      $s2 = "MYWSCRIPT2" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 800KB and ( $x1 or 2 of them )

Full rule:
rule MyWScript_CompiledScript {
   meta:
      description = "Detects a scripte with default name Mywscript compiled with Script2Exe (can also be a McAfee tool https://community.mcafee.com/docs/DOC-4124)"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-07-27"
      score = 65
      hash1 = "515f5188ba6d039b8c38f60d3d868fa9c9726e144f593066490c7c97bf5090c8"
      id = "a0480a8a-5a7e-5829-851b-7301cfc9da60"
   strings:
      $x1 = "C:\\Projets\\vbsedit_source\\script2exe\\Release\\mywscript.pdb" fullword ascii
      $s1 = "mywscript2" fullword wide
      $s2 = "MYWSCRIPT2" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 800KB and ( $x1 or 2 of them )
}
YARA Detection Rule: Fidelis_Advisory_Purchase_Order_pps
Repository: Neo23x0/signature-base
Detects: Detects a string found in a malicious document named Purchase_Order.pps
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/ZjJyti

Pattern signatures:
$s0 = "Users\\Gozie\\Desktop\\Purchase-Order.gif" ascii

Detection condition:
all of them

Full rule:
rule Fidelis_Advisory_Purchase_Order_pps {
    meta:
        description = "Detects a string found in a malicious document named Purchase_Order.pps"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        reference = "http://goo.gl/ZjJyti"
        date = "2015-06-09"
        id = "205c4cda-6874-5455-8eb9-b63fb09b13fd"
    strings:
        $s0 = "Users\\Gozie\\Desktop\\Purchase-Order.gif" ascii
    condition:
        all of them
}
YARA Detection Rule: Fidelis_Advisory_cedt370
Repository: Neo23x0/signature-base
Detects: Detects a string found in memory of malware cedt370r(3).exe
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/ZjJyti

Pattern signatures:
$s0 = "PO.exe" ascii fullword
        $s1 = "Important.exe" ascii fullword
        $s2 = "&username=" ascii fullword
        $s3 = "Browsers.txt" ascii fullword

Detection condition:
all of them

Full rule:
rule Fidelis_Advisory_cedt370 {
    meta:
        description = "Detects a string found in memory of malware cedt370r(3).exe"
        author = "Florian Roth (Nextron Systems)"
        reference = "http://goo.gl/ZjJyti"
        date = "2015-06-09"
        id = "b5ebf2d7-e3e4-5b3b-a082-417da9c7fda6"
    strings:
        $s0 = "PO.exe" ascii fullword
        $s1 = "Important.exe" ascii fullword
        $s2 = "&username=" ascii fullword
        $s3 = "Browsers.txt" ascii fullword
    condition:
        all of them
}