deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: remsec_executable_blob_parser
Repository: Neo23x0/signature-base
Detects: Detects malware from Symantec's Strider APT report
Reference: http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets

Pattern signatures:
$code = { ( 0F 82 ?? ?? 00 00 | 72 ?? ) ( 80 | 41 80 ) ( 7? | 7C 24 ) 04 02 ( 0F 85 ?? ?? 00 00 | 75 ?? ) ( 81 | 41 81 ) ( 3? | 3C 24 | 7D 00 ) 02 AA 02 C1 ( 0F 85 ?? ?? 00 00 | 75 ?? ) ( 8B | 41 8B | 44 8B | 45 8B ) ( 4? | 5? | 6? | 7? | ?4 24 | ?C 24 ) 06 }

Detection condition:
all of them

Full rule:
rule remsec_executable_blob_parser {
   meta:
      copyright = "Symantec"
      description = "Detects malware from Symantec's Strider APT report"
      score = 80
      date = "2016/08/08"
      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
      id = "b2189bfe-7b84-5fe9-8829-64f49d1e2030"
   strings:
      $code = { ( 0F 82 ?? ?? 00 00 | 72 ?? ) ( 80 | 41 80 ) ( 7? | 7C 24 ) 04 02 ( 0F 85 ?? ?? 00 00 | 75 ?? ) ( 81 | 41 81 ) ( 3? | 3C 24 | 7D 00 ) 02 AA 02 C1 ( 0F 85 ?? ?? 00 00 | 75 ?? ) ( 8B | 41 8B | 44 8B | 45 8B ) ( 4? | 5? | 6? | 7? | ?4 24 | ?C 24 ) 06 }
   condition:
      all of them
}
YARA Detection Rule: remsec_encrypted_api
Repository: Neo23x0/signature-base
Detects: Detects malware from Symantec's Strider APT report
Reference: http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets

Pattern signatures:
$open_process = { 91 9A 8F B0 9C 90 8D AF 8C 8C 9A FF }

Detection condition:
all of them

Full rule:
rule remsec_encrypted_api {
   meta:
      copyright = "Symantec"
      description = "Detects malware from Symantec's Strider APT report"
      score = 80
      date = "2016/08/08"
      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
      id = "1aa3380b-d704-5eb9-b25d-f4bf20ae7179"
   strings:
      $open_process = { 91 9A 8F B0 9C 90 8D AF 8C 8C 9A FF }
   condition:
      all of them
}
YARA Detection Rule: remsec_packer_A
Repository: Neo23x0/signature-base
Detects: Detects malware from Symantec's Strider APT report
Reference: http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets

Pattern signatures:
$code = { 69 ( C? | D? | E? | F? ) AB 00 00 00 ( 81 | 41 81 ) C? CD 2B 00 00 ( F7 | 41 F7 ) E? ( C1 | 41 C1 ) E? 0D ( 69 | 45 69 ) ( C? | D? | E? | F? ) 85 CF 00 00 ( 29 | 41 29 | 44 29 | 45 29 | 2B | 41 2B | 44 2B | 45 2B ) }

Detection condition:
all of them

Full rule:
rule remsec_packer_A {
   meta:
      copyright = "Symantec"
      description = "Detects malware from Symantec's Strider APT report"
      score = 80
      date = "2016/08/08"
      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
      id = "d75198ab-b1ea-572a-a674-9a38c3e2958b"
   strings:
      $code = { 69 ( C? | D? | E? | F? ) AB 00 00 00 ( 81 | 41 81 ) C? CD 2B 00 00 ( F7 | 41 F7 ) E? ( C1 | 41 C1 ) E? 0D ( 69 | 45 69 ) ( C? | D? | E? | F? ) 85 CF 00 00 ( 29 | 41 29 | 44 29 | 45 29 | 2B | 41 2B | 44 2B | 45 2B ) }
   condition:
      all of them
}
YARA Detection Rule: remsec_packer_B
Repository: Neo23x0/signature-base
Detects: Detects malware from Symantec's Strider APT report
Reference: http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets

Pattern signatures:
$code = { 48 8B 05 ?? ?? ?? ?? 48 89 44 24 ?? 48 8B 05 ?? ?? ?? ?? 48 8D 4C 24 ?? 48 89 44 24 ?? 48 8D ( 45 ?? | 84 24 ?? ?? 00 00 ) ( 44 88 6? 24 ?? | C6 44 24 ?? 00 ) 48 89 44 24 ?? 48 8D ( 45 ?? | 84 24 ?? ?? 00 00 ) C7 44 24 ?? 0? 00 00 00 2B ?8 48 89 ?C 24 ?? 44 89 6? 24 ?? 83 C? 08 89 ?C 24 ?? ( FF | 41 FF ) D? ( 05 | 8D 88 ) 00 00 00 3A }

Detection condition:
all of them

Full rule:
rule remsec_packer_B {
   meta:
      copyright = "Symantec"
      description = "Detects malware from Symantec's Strider APT report"
      score = 80
      date = "2016/08/08"
      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
      id = "18e7f84e-27f2-532d-9ead-0db6e9e6c0b2"
   strings:
      $code = { 48 8B 05 ?? ?? ?? ?? 48 89 44 24 ?? 48 8B 05 ?? ?? ?? ?? 48 8D 4C 24 ?? 48 89 44 24 ?? 48 8D ( 45 ?? | 84 24 ?? ?? 00 00 ) ( 44 88 6? 24 ?? | C6 44 24 ?? 00 ) 48 89 44 24 ?? 48 8D ( 45 ?? | 84 24 ?? ?? 00 00 ) C7 44 24 ?? 0? 00 00 00 2B ?8 48 89 ?C 24 ?? 44 89 6? 24 ?? 83 C? 08 89 ?C 24 ?? ( FF | 41 FF ) D? ( 05 | 8D 88 ) 00 00 00 3A }
   condition:
      all of them
}
YARA Detection Rule: PlugX_J16_Gen
Repository: Neo23x0/signature-base
Detects: Detects PlugX Malware samples from June 2016
Author: Florian Roth (Nextron Systems)
Reference: VT Research

Pattern signatures:
$x1 = "%WINDIR%\\SYSTEM32\\SERVICES.EXE" fullword wide
		$x2 = "\\\\.\\PIPE\\RUN_AS_USER(%d)" fullword wide
		$x3 = "LdrLoadShellcode" fullword ascii
		$x4 = "Protocol:[%4s], Host: [%s:%d], Proxy: [%d:%s:%d:%s:%s]" fullword ascii

		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\User Agent\\Post Platform" fullword wide
		$s2 = "%s\\msiexec.exe %d %d" fullword wide
		$s3 = "l%s\\sysprep\\CRYPTBASE.DLL" fullword wide
		$s4 = "%s\\msiexec.exe UAC" fullword wide
		$s5 = "CRYPTBASE.DLL" fullword wide
		$s6 = "%ALLUSERSPROFILE%\\SxS" fullword wide
		$s7 = "%s\\sysprep\\sysprep.exe" fullword wide
		$s8 = "\\\\.\\pipe\\a%d" fullword wide
		$s9 = "\\\\.\\pipe\\b%d" fullword wide
		$s10 = "EName:%s,EAddr:0x%p,ECode:0x%p,EAX:%p,EBX:%p,ECX:%p,EDX:%p,ESI:%p,EDI:%p,EBP:%p,ESP:%p,EIP:%p" fullword ascii
		$s11 = "Mozilla/4.0 (compatible; MSIE " fullword wide
		$s12 = "; Windows NT %d.%d" fullword wide
		$s13 = "SOFTWARE\\Microsoft\\Internet Explorer\\Version Vector" fullword w

Detection condition:
( uint16(0) == 0x5a4d and filesize < 600KB and ( 1 of ($x*) or 4 of ($s*) ) ) or ( 8 of them )

Full rule:
rule PlugX_J16_Gen {
	meta:
		description = "Detects PlugX Malware samples from June 2016"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "VT Research"
		date = "2016-06-08"
		id = "13ef1e80-7090-5a1e-bca7-8d3de0dc2247"
	strings:
		$x1 = "%WINDIR%\\SYSTEM32\\SERVICES.EXE" fullword wide
		$x2 = "\\\\.\\PIPE\\RUN_AS_USER(%d)" fullword wide
		$x3 = "LdrLoadShellcode" fullword ascii
		$x4 = "Protocol:[%4s], Host: [%s:%d], Proxy: [%d:%s:%d:%s:%s]" fullword ascii

		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\User Agent\\Post Platform" fullword wide
		$s2 = "%s\\msiexec.exe %d %d" fullword wide
		$s3 = "l%s\\sysprep\\CRYPTBASE.DLL" fullword wide
		$s4 = "%s\\msiexec.exe UAC" fullword wide
		$s5 = "CRYPTBASE.DLL" fullword wide
		$s6 = "%ALLUSERSPROFILE%\\SxS" fullword wide
		$s7 = "%s\\sysprep\\sysprep.exe" fullword wide
		$s8 = "\\\\.\\pipe\\a%d" fullword wide
		$s9 = "\\\\.\\pipe\\b%d" fullword wide
		$s10 = "EName:%s,EAddr:0x%p,ECode:0x%p,EAX:%p,EBX:%p,ECX:%p,EDX:%p,ESI:%p,EDI:%p,EBP:%p,ESP:%p,EIP:%p" fullword ascii
		$s11 = "Mozilla/4.0 (compatible; MSIE " fullword wide
		$s12 = "; Windows NT %d.%d" fullword wide
		$s13 = "SOFTWARE\\Microsoft\\Internet Explorer\\Version Vector" fullword wide
		$s14 = "\\bug.log" wide
	condition:
		( uint16(0) == 0x5a4d and filesize < 600KB and ( 1 of ($x*) or 4 of ($s*) ) ) or ( 8 of them )
}
YARA Detection Rule: PlugX_J16_Gen2
Repository: Neo23x0/signature-base
Detects: Detects PlugX Malware Samples from June 2016
Author: Florian Roth (Nextron Systems)
Reference: VT Research

Pattern signatures:
$s1 = "XPlugKeyLogger.cpp" fullword ascii
		$s2 = "XPlugProcess.cpp" fullword ascii
		$s4 = "XPlgLoader.cpp" fullword ascii
		$s5 = "XPlugPortMap.cpp" fullword ascii
		$s8 = "XPlugShell.cpp" fullword ascii
		$s11 = "file: %s, line: %d, error: [%d]%s" fullword ascii
		$s12 = "XInstall.cpp" fullword ascii
		$s13 = "XPlugTelnet.cpp" fullword ascii
		$s14 = "XInstallUAC.cpp" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 600KB and ( 2 of ($s*) ) ) or ( 5 of them )

Full rule:
rule PlugX_J16_Gen2 {
	meta:
		description = "Detects PlugX Malware Samples from June 2016"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "VT Research"
		date = "2016-06-08"
		id = "28e9cbb9-cd60-555d-b033-4e2bf293adf2"
	strings:
		$s1 = "XPlugKeyLogger.cpp" fullword ascii
		$s2 = "XPlugProcess.cpp" fullword ascii
		$s4 = "XPlgLoader.cpp" fullword ascii
		$s5 = "XPlugPortMap.cpp" fullword ascii
		$s8 = "XPlugShell.cpp" fullword ascii
		$s11 = "file: %s, line: %d, error: [%d]%s" fullword ascii
		$s12 = "XInstall.cpp" fullword ascii
		$s13 = "XPlugTelnet.cpp" fullword ascii
		$s14 = "XInstallUAC.cpp" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 600KB and ( 2 of ($s*) ) ) or ( 5 of them )
}
YARA Detection Rule: crime_h2miner_kinsing
Repository: Neo23x0/signature-base
Detects: Rule to find Kinsing malware
Author: Tony Lambert, Red Canary

Pattern signatures:
$s1 = "-iL $INPUT --rate $RATE -p$PORT -oL $OUTPUT"
        $s2 = "libpcap"
        $s3 = "main.backconnect"
        $s4 = "main.masscan"
        $s5 = "main.checkHealth"
        $s6 = "main.redisBrute"
        $s7 = "ActiveC2CUrl"
        $s8 = "main.RC4"
        $s9 = "main.runTask"

Detection condition:
(uint32(0) == 0x464C457F) and filesize > 1MB and all of them

Full rule:
rule crime_h2miner_kinsing
{
    meta:
        description = "Rule to find Kinsing malware"
        author = "Tony Lambert, Red Canary"
        date = "2020-06-09"
        id = "1cabca0d-7134-517e-b82e-f2b20b4d1c34"
    strings:
        $s1 = "-iL $INPUT --rate $RATE -p$PORT -oL $OUTPUT"
        $s2 = "libpcap"
        $s3 = "main.backconnect"
        $s4 = "main.masscan"
        $s5 = "main.checkHealth"
        $s6 = "main.redisBrute"
        $s7 = "ActiveC2CUrl"
        $s8 = "main.RC4"
        $s9 = "main.runTask"
    condition:
        (uint32(0) == 0x464C457F) and filesize > 1MB and all of them 
}
YARA Detection Rule: ONHAT_Proxy_Hacktool
Repository: Neo23x0/signature-base
Detects: Detects ONHAT Proxy - Htran like SOCKS hack tool used by Chinese APT groups
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/p32Ozf

Pattern signatures:
$s1 = "INVALID PARAMETERS. TYPE ONHAT.EXE -h FOR HELP INFORMATION." fullword ascii
		$s2 = "[ONHAT] LISTENS (S, %d.%d.%d.%d, %d) ERROR." fullword ascii
		$s3 = "[ONHAT] CONNECTS (T, %d.%d.%d.%d, %d.%d.%d.%d, %d) ERROR." fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 80KB and ( 1 of ($s*) ) ) or ( 2 of them )

Full rule:
rule ONHAT_Proxy_Hacktool {
	meta:
		description = "Detects ONHAT Proxy - Htran like SOCKS hack tool used by Chinese APT groups"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/p32Ozf"
		date = "2016-05-12"
		score = 100
		hash1 = "30b2de0a802a65b4db3a[PII_REDACTED]e6949c1249e68056158b2cc74798bac97"
		hash2 = "94bda24559713c7b8be91368c5016fc7679121fea5d565d3d11b2bb5d5529340"
		hash3 = "a26e75fec3b9f7d5a1c3d0ce1e89e4b0befb7a601da0c69a4cf[PII_REDACTED]1dd"
		hash4 = "c202e9d5b99f6137c7c07305c7314e55f52bae832d460c44efc8f2a90ff03615"
		hash5 = "dded62ad85c0bdd68bcc96f88d8ba42d5ad0ef999911ebdea3f561a4491ebbc6"
		hash6 = "f0954774c91603fc2595f0ba0727b9af4e80f6f9be7bb629e7fb6ba4309ed4ea"
		hash7 = "f3906be01d51e2e1ae9b03cd09702b6e0794b9c9fd7dc04024f897e96bb13232"
		hash8 = "f65ae9ccf988a06a152f27a4c0d7992100a2d9d23d80efe8d8c2a5c9bd78a3a7"
		id = "cb18a5b0-dbbd-5dd3-af66-21b8302df6de"
	strings:
		$s1 = "INVALID PARAMETERS. TYPE ONHAT.EXE -h FOR HELP INFORMATION." fullword ascii
		$s2 = "[ONHAT] LISTENS (S, %d.%d.%d.%d, %d) ERROR." fullword ascii
		$s3 = "[ONHAT] CONNECTS (T, %d.%d.%d.%d, %d.%d.%d.%d, %d) ERROR." fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 80KB and ( 1 of ($s*) ) ) or ( 2 of them )
}
YARA Detection Rule: susp_file_enumerator_with_encrypted_resource_101
Repository: Neo23x0/signature-base
Detects: Generic detection for samples that enumerate files with encrypted resource called 101
Reference: https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/

Pattern signatures:
$mz = "This program cannot be run in DOS mode."
      $a1 = "FindFirstFile" ascii wide nocase
      $a2 = "FindNextFile" ascii wide nocase
      $a3 = "FindResource" ascii wide nocase
      $a4 = "LoadResource" ascii wide nocase

Detection condition:
uint16(0) == 0x5A4D and
      all of them and
      filesize < 700000 and
      pe.number_of_sections > 4 and
      pe.number_of_resources > 1 and pe.number_of_resources < 15 and
      for any i in (0..pe.number_of_resources - 1):
         (
            (math.entropy(pe.resources[i].offset, pe.resou

Full rule:
rule susp_file_enumerator_with_encrypted_resource_101 {
   meta:
      copyright = "Kaspersky Lab"
      description = "Generic detection for samples that enumerate files with encrypted resource called 101"
      hash = "2cd0a5f1e9bcce6807e57ec8477d222a"
      hash = "c843046e54b755ec63ccb09d0a689674"
      reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
      version = "1.4"
      id = "9bc16ec2-c94c-54f5-b09c-88a78e9e3fb2"
   strings:
      $mz = "This program cannot be run in DOS mode."
      $a1 = "FindFirstFile" ascii wide nocase
      $a2 = "FindNextFile" ascii wide nocase
      $a3 = "FindResource" ascii wide nocase
      $a4 = "LoadResource" ascii wide nocase
   condition:
      uint16(0) == 0x5A4D and
      all of them and
      filesize < 700000 and
      pe.number_of_sections > 4 and
      pe.number_of_resources > 1 and pe.number_of_resources < 15 and
      for any i in (0..pe.number_of_resources - 1):
         (
            (math.entropy(pe.resources[i].offset, pe.resources[i].length) > 7.8) and
            pe.resources[i].id == 101 and
            pe.resources[i].length > 20000 and
            pe.resources[i].language == 0 and
            not ($mz in (pe.resources[i].offset..pe.resources[i].offset + pe.resources[i].length))
         )
}
YARA Detection Rule: StoneDrill_main_sub
Repository: Neo23x0/signature-base
Detects: Rule to detect StoneDrill (decrypted) samples
Author: Kaspersky Lab
Reference: https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/

Pattern signatures:
$code = {B8 08 00 FE 7F FF 30 8F 44 24 ?? 68 B4 0F 00 00 FF 15 ?? ?? ?? 00 B8 08 00 FE 7F FF 30 8F 44 24 ?? 8B ?? 24 [1 - 4] 2B ?? 24 [6] F7 ?1 [5 - 12] 00}

Detection condition:
uint16(0) == 0x5A4D and $code and filesize < 5000000

Full rule:
rule StoneDrill_main_sub {
   meta:
      author = "Kaspersky Lab"
      description = "Rule to detect StoneDrill (decrypted) samples"
      hash1 = "d01781f1246fd1b64e09170bd6600fe1"
      hash2 = "ac3c25534c076623192b9381f926ba0d"
      reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
      version = "1.0"
      id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
   strings:
      $code = {B8 08 00 FE 7F FF 30 8F 44 24 ?? 68 B4 0F 00 00 FF 15 ?? ?? ?? 00 B8 08 00 FE 7F FF 30 8F 44 24 ?? 8B ?? 24 [1 - 4] 2B ?? 24 [6] F7 ?1 [5 - 12] 00}
   condition:
      uint16(0) == 0x5A4D and $code and filesize < 5000000
}
YARA Detection Rule: StoneDrill_BAT_1
Repository: Neo23x0/signature-base
Detects: Rule to detect Batch file from StoneDrill report
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/

Pattern signatures:
$s1 = "set u100=" ascii
      $s2 = "set u200=service" ascii fullword
      $s3 = "set u800=%~dp0" ascii fullword
      $s4 = "\"%systemroot%\\system32\\%u100%\"" ascii
      $s5 = "%\" start /b %systemroot%\\system32\\%" ascii

Detection condition:
uint32(0) == 0x68636540 and 2 of them and filesize < 500

Full rule:
rule StoneDrill_BAT_1 {
   meta:
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      description = "Rule to detect Batch file from StoneDrill report"
      reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
      id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
   strings:
      $s1 = "set u100=" ascii
      $s2 = "set u200=service" ascii fullword
      $s3 = "set u800=%~dp0" ascii fullword
      $s4 = "\"%systemroot%\\system32\\%u100%\"" ascii
      $s5 = "%\" start /b %systemroot%\\system32\\%" ascii
   condition:
      uint32(0) == 0x68636540 and 2 of them and filesize < 500
}
YARA Detection Rule: StoneDrill_Service_Install
Repository: Neo23x0/signature-base
Detects: Rule to detect Batch file from StoneDrill report
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/

Pattern signatures:
$s1 = "127.0.0.1 >nul && sc config" ascii
      $s2 = "LocalService\" && ping -n" ascii fullword
      $s3 = "127.0.0.1 >nul && sc start" ascii fullword
      $s4 = "sc config NtsSrv binpath= \"C:\\WINDOWS\\system32\ntssrvr64.exe" ascii

Detection condition:
2 of them and filesize < 500

Full rule:
rule StoneDrill_Service_Install {
   meta:
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      description = "Rule to detect Batch file from StoneDrill report"
      reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
      id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
   strings:
      $s1 = "127.0.0.1 >nul && sc config" ascii
      $s2 = "LocalService\" && ping -n" ascii fullword
      $s3 = "127.0.0.1 >nul && sc start" ascii fullword
      $s4 = "sc config NtsSrv binpath= \"C:\\WINDOWS\\system32\ntssrvr64.exe" ascii
   condition:
      2 of them and filesize < 500
}
YARA Detection Rule: StoneDrill_ntssrvr32
Repository: Neo23x0/signature-base
Detects: Detects malware from StoneDrill threat report
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/

Pattern signatures:
$s1 = "g\\system32\\" wide
      $s2 = "ztvttw" fullword wide
      $s3 = "lwizvm" fullword ascii

      $op1 = { 94 35 77 73 03 40 eb e9 }
      $op2 = { 80 7c 41 01 00 74 0a 3d }
      $op3 = { 74 0a 3d 00 94 35 77 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 4000KB and 3 of them )

Full rule:
rule StoneDrill_ntssrvr32 {
   meta:
      description = "Detects malware from StoneDrill threat report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
      date = "2017-03-07"
      modified = "2023-01-27"
      hash1 = "394a7ebad5dfc13d6c75945a61063470dc3b68f7a207613b79ef000e1990909b"
      id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
   strings:
      $s1 = "g\\system32\\" wide
      $s2 = "ztvttw" fullword wide
      $s3 = "lwizvm" fullword ascii

      $op1 = { 94 35 77 73 03 40 eb e9 }
      $op2 = { 80 7c 41 01 00 74 0a 3d }
      $op3 = { 74 0a 3d 00 94 35 77 }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 4000KB and 3 of them )
}
YARA Detection Rule: StoneDrill_Malware_2
Repository: Neo23x0/signature-base
Detects: Detects malware from StoneDrill threat report
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/

Pattern signatures:
$s1 = "cmd /c WMIC Process Call Create \"C:\\Windows\\System32\\Wscript.exe //NOLOGO " fullword wide
      $s2 = "C:\\ProgramData\\InternetExplorer" fullword wide
      $s3 = "WshShell.CopyFile \"" fullword wide
      $s4 = "Abd891.tmp" fullword wide
      $s5 = "Set WshShell = Nothing" fullword wide
      $s6 = "AaCcdDeFfGhiKLlMmnNoOpPrRsSTtUuVvwWxyZz32" fullword ascii
      $s7 = "\\FileInfo.txt" wide

      $x1 = "C-PDI-C-Cpy-T.vbs" fullword wide
      $x2 = "C-Dlt-C-Org-T.vbs" fullword wide
      $x3 = "C-PDC-C-Cpy-T.vbs" fullword wide
      $x4 = "AC-PDC-C-Cpy-T.vbs" fullword wide
      $x5 = "C-Dlt-C-Trsh-T.tmp" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 700KB and ( 1 of ($x*) or 3 of ($s*) ) ) or 5 of them

Full rule:
rule StoneDrill_Malware_2 {
   meta:
      description = "Detects malware from StoneDrill threat report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
      date = "2017-03-07"
      hash1 = "69530d78c86031ce32583c6800f5ffc629acacb18aac4c8bb5b0e915fc4cc4db"
      id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
   strings:
      $s1 = "cmd /c WMIC Process Call Create \"C:\\Windows\\System32\\Wscript.exe //NOLOGO " fullword wide
      $s2 = "C:\\ProgramData\\InternetExplorer" fullword wide
      $s3 = "WshShell.CopyFile \"" fullword wide
      $s4 = "Abd891.tmp" fullword wide
      $s5 = "Set WshShell = Nothing" fullword wide
      $s6 = "AaCcdDeFfGhiKLlMmnNoOpPrRsSTtUuVvwWxyZz32" fullword ascii
      $s7 = "\\FileInfo.txt" wide

      $x1 = "C-PDI-C-Cpy-T.vbs" fullword wide
      $x2 = "C-Dlt-C-Org-T.vbs" fullword wide
      $x3 = "C-PDC-C-Cpy-T.vbs" fullword wide
      $x4 = "AC-PDC-C-Cpy-T.vbs" fullword wide
      $x5 = "C-Dlt-C-Trsh-T.tmp" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 700KB and ( 1 of ($x*) or 3 of ($s*) ) ) or 5 of them
}
YARA Detection Rule: StoneDrill
Repository: Neo23x0/signature-base
Detects: Detects malware from StoneDrill threat report
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/

Pattern signatures:
$x1 = "C-Dlt-C-Trsh-T.tmp" fullword wide
      $x2 = "C-Dlt-C-Org-T.vbs" fullword wide

      $s1 = "Hello dear" fullword ascii
      $s2 = "WRZRZRAR" fullword ascii

      $opa1 = { 66 89 45 d8 6a 64 ff }
      $opa2 = { 8d 73 01 90 0f bf 51 fe }

Detection condition:
uint16(0) == 0x5a4d and filesize < 700KB and 1 of ($x*) or ( all of ($op*) and all of ($s*) )

Full rule:
rule StoneDrill {
   meta:
      description = "Detects malware from StoneDrill threat report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
      date = "2017-03-07"
      super_rule = 1
      hash1 = "2bab3716a1f19879ca2e6d98c518debb107e0ed8e1534241f[PII_REDACTED]aac83"
      hash2 = "62aabce7a5741a9270cddac49cd1d715305c1d0505e620bbeaec6ff9b6fd0260"
      hash3 = "69530d78c86031ce32583c6800f5ffc629acacb18aac4c8bb5b0e915fc4cc4db"
      id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
   strings:
      $x1 = "C-Dlt-C-Trsh-T.tmp" fullword wide
      $x2 = "C-Dlt-C-Org-T.vbs" fullword wide

      $s1 = "Hello dear" fullword ascii
      $s2 = "WRZRZRAR" fullword ascii

      $opa1 = { 66 89 45 d8 6a 64 ff }
      $opa2 = { 8d 73 01 90 0f bf 51 fe }
   condition:
      uint16(0) == 0x5a4d and filesize < 700KB and 1 of ($x*) or ( all of ($op*) and all of ($s*) )
}