deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: HKTL_Empire_PowerUp
Repository: Neo23x0/signature-base
Detects: Detects Empire component - file PowerUp.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$x2 = "$PoolPasswordCmd = 'c:\\windows\\system32\\inetsrv\\appcmd.exe list apppool" fullword ascii

Detection condition:
( uint16(0) == 0x233c and filesize < 2000KB and 1 of them ) or all of them

Full rule:
rule HKTL_Empire_PowerUp {
   meta:
      description = "Detects Empire component - file PowerUp.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "ad9a5dff257828ba5f15331d59dd4def3989537b3b6375495d0c[PII_REDACTED]8c"
      id = "e79d093e-7481-52a3-a350-4d1b6d8955cd"
   strings:
      $x2 = "$PoolPasswordCmd = 'c:\\windows\\system32\\inetsrv\\appcmd.exe list apppool" fullword ascii
   condition:
      ( uint16(0) == 0x233c and filesize < 2000KB and 1 of them ) or all of them
}
YARA Detection Rule: Empire_Invoke_Mimikatz_Gen
Repository: Neo23x0/signature-base
Detects: Detects Empire component - file Invoke-Mimikatz.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$s1 = "= \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQ" ascii
      $s2 = "Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes64, $PEBytes32, \"Void\", 0, \"\", $ExeArgs)" fullword ascii

Detection condition:
( uint16(0) == 0x7566 and filesize < 4000KB and 1 of them ) or all of them

Full rule:
rule Empire_Invoke_Mimikatz_Gen {
   meta:
      description = "Detects Empire component - file Invoke-Mimikatz.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
      id = "1f771a17-2534-5811-80bd-bc1bab37d97c"
   strings:
      $s1 = "= \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQ" ascii
      $s2 = "Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes64, $PEBytes32, \"Void\", 0, \"\", $ExeArgs)" fullword ascii
   condition:
      ( uint16(0) == 0x7566 and filesize < 4000KB and 1 of them ) or all of them
}
YARA Detection Rule: Empire_Get_GPPPassword
Repository: Neo23x0/signature-base
Detects: Detects Empire component - file Get-GPPPassword.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$s1 = "$Base64Decoded = [Convert]::FromBase64String($Cpassword)" fullword ascii
      $s2 = "$XMlFiles += Get-ChildItem -Path \"\\\\$DomainController\\SYSVOL\" -Recurse" ascii
      $s3 = "function Get-DecryptedCpassword {" fullword ascii

Detection condition:
( uint16(0) == 0x7566 and filesize < 30KB and 1 of them ) or all of them

Full rule:
rule Empire_Get_GPPPassword {
   meta:
      description = "Detects Empire component - file Get-GPPPassword.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "55a4519c4f243148a971e[PII_REDACTED]a7ce730b3045bde[PII_REDACTED]ebcc38b0"
      id = "7791b009-19d3-5d08-8ef7-4723d28830ed"
   strings:
      $s1 = "$Base64Decoded = [Convert]::FromBase64String($Cpassword)" fullword ascii
      $s2 = "$XMlFiles += Get-ChildItem -Path \"\\\\$DomainController\\SYSVOL\" -Recurse" ascii
      $s3 = "function Get-DecryptedCpassword {" fullword ascii
   condition:
      ( uint16(0) == 0x7566 and filesize < 30KB and 1 of them ) or all of them
}
YARA Detection Rule: Empire_Invoke_SmbScanner
Repository: Neo23x0/signature-base
Detects: Detects Empire component - file Invoke-SmbScanner.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$s1 = "$up = Test-Connection -count 1 -Quiet -ComputerName $Computer " fullword ascii
      $s2 = "$out | add-member Noteproperty 'Password' $Password" fullword ascii

Detection condition:
( uint16(0) == 0x7566 and filesize < 10KB and 1 of them ) or all of them

Full rule:
rule Empire_Invoke_SmbScanner {
   meta:
      description = "Detects Empire component - file Invoke-SmbScanner.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "9a705f30766279d1e91273cfb1ce[PII_REDACTED]a109908e9a986cc2d38a7ab1dd"
      id = "63cd048b-04fd-5b4f-9d4d-3a001c31b4df"
   strings:
      $s1 = "$up = Test-Connection -count 1 -Quiet -ComputerName $Computer " fullword ascii
      $s2 = "$out | add-member Noteproperty 'Password' $Password" fullword ascii
   condition:
      ( uint16(0) == 0x7566 and filesize < 10KB and 1 of them ) or all of them
}
YARA Detection Rule: Empire_Exploit_JBoss
Repository: Neo23x0/signature-base
Detects: Detects Empire component - file Exploit-JBoss.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$s1 = "Exploit-JBoss" fullword ascii
      $s2 = "$URL = \"http$($SSL)://\" + $($Rhost) + ':' + $($Port)" ascii
      $s3 = "\"/jmx-console/HtmlAdaptor?action=invokeOp&name=jboss.system:service" ascii
      $s4 = "http://blog.rvrsh3ll.net" fullword ascii
      $s5 = "Remote URL to your own WARFile to deploy." fullword ascii

Detection condition:
( uint16(0) == 0x7566 and filesize < 10KB and 1 of them ) or all of them

Full rule:
rule Empire_Exploit_JBoss {
   meta:
      description = "Detects Empire component - file Exploit-JBoss.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "9ea3e00b299e644551d90bbee0ce3e4e82445aa15dab7adb7fcc0b7f1fe4e653"
      id = "a9c75cf5-9469-5a45-b750-69728ed0069f"
   strings:
      $s1 = "Exploit-JBoss" fullword ascii
      $s2 = "$URL = \"http$($SSL)://\" + $($Rhost) + ':' + $($Port)" ascii
      $s3 = "\"/jmx-console/HtmlAdaptor?action=invokeOp&name=jboss.system:service" ascii
      $s4 = "http://blog.rvrsh3ll.net" fullword ascii
      $s5 = "Remote URL to your own WARFile to deploy." fullword ascii
   condition:
      ( uint16(0) == 0x7566 and filesize < 10KB and 1 of them ) or all of them
}
YARA Detection Rule: Empire_dumpCredStore
Repository: Neo23x0/signature-base
Detects: Detects Empire component - file dumpCredStore.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$x1 = "[DllImport(\"Advapi32.dll\", SetLastError = true, EntryPoint = \"CredReadW\"" ascii
      $s12 = "[String] $Msg = \"Failed to enumerate credentials store for user '$Env:UserName'\"" fullword ascii
      $s15 = "Rtn = CredRead(\"Target\", CRED_TYPE.GENERIC, out Cred);" fullword ascii

Detection condition:
( uint16(0) == 0x233c and filesize < 40KB and 1 of them ) or all of them

Full rule:
rule Empire_dumpCredStore {
   meta:
      description = "Detects Empire component - file dumpCredStore.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "c1e91a5f9cc23f3626326dab2dcdf4904e6f8a332e2bce8b9a0854b371c2b350"
      id = "cdb87ed4-fa90-5724-b37d-97cf8e4b8326"
   strings:
      $x1 = "[DllImport(\"Advapi32.dll\", SetLastError = true, EntryPoint = \"CredReadW\"" ascii
      $s12 = "[String] $Msg = \"Failed to enumerate credentials store for user '$Env:UserName'\"" fullword ascii
      $s15 = "Rtn = CredRead(\"Target\", CRED_TYPE.GENERIC, out Cred);" fullword ascii
   condition:
      ( uint16(0) == 0x233c and filesize < 40KB and 1 of them ) or all of them
}
YARA Detection Rule: Empire_Invoke_EgressCheck
Repository: Neo23x0/signature-base
Detects: Detects Empire component - file Invoke-EgressCheck.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$s1 = "egress -ip $ip -port $c -delay $delay -protocol $protocol" fullword ascii

Detection condition:
( uint16(0) == 0x233c and filesize < 10KB and 1 of them ) or all of them

Full rule:
rule Empire_Invoke_EgressCheck {
   meta:
      description = "Detects Empire component - file Invoke-EgressCheck.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "e2d270266abe03cfdac66e6fc0598c715e48d6d335adf09a9ed[PII_REDACTED]534"
      id = "21e09250-6853-5743-a6ef-aa6be8091d33"
   strings:
      $s1 = "egress -ip $ip -port $c -delay $delay -protocol $protocol" fullword ascii
   condition:
      ( uint16(0) == 0x233c and filesize < 10KB and 1 of them ) or all of them
}
YARA Detection Rule: Empire_ReflectivePick_x64_orig
Repository: Neo23x0/signature-base
Detects: Detects Empire component - file ReflectivePick_x64_orig.dll
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$a1 = "\\PowerShellRunner.pdb" ascii
      $a2 = "PowerShellRunner.dll" fullword wide
      
      $s1 = "ReflectivePick" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 400KB and 1 of ($a*) and $s1

Full rule:
rule Empire_ReflectivePick_x64_orig {
   meta:
      description = "Detects Empire component - file ReflectivePick_x64_orig.dll"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      modified = "2022-12-21"
      hash1 = "a8c1b108a67e7fc09f81bd160c3bafb526caf3dbbaf008efb9a96f4151756ff2"
      id = "cd69a149-d881-5f93-9647-84241bd96ba5"
   strings:
      $a1 = "\\PowerShellRunner.pdb" ascii
      $a2 = "PowerShellRunner.dll" fullword wide
      
      $s1 = "ReflectivePick" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 400KB and 1 of ($a*) and $s1
}
YARA Detection Rule: Empire_Out_Minidump
Repository: Neo23x0/signature-base
Detects: Detects Empire component - file Out-Minidump.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$s1 = "$Result = $MiniDumpWriteDump.Invoke($null, @($ProcessHandle," fullword ascii
      $s2 = "$ProcessFileName = \"$($ProcessName)_$($ProcessId).dmp\"" fullword ascii

Detection condition:
( uint16(0) == 0x7566 and filesize < 10KB and 1 of them ) or all of them

Full rule:
rule Empire_Out_Minidump {
   meta:
      description = "Detects Empire component - file Out-Minidump.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "7803ae7ba5d4e7d38e73745b3f321c2ca714f3141699d984322fa92e0ff037a1"
      id = "8c53d2ab-afc5-5d7b-97e1-496425b9664f"
   strings:
      $s1 = "$Result = $MiniDumpWriteDump.Invoke($null, @($ProcessHandle," fullword ascii
      $s2 = "$ProcessFileName = \"$($ProcessName)_$($ProcessId).dmp\"" fullword ascii
   condition:
      ( uint16(0) == 0x7566 and filesize < 10KB and 1 of them ) or all of them
}
YARA Detection Rule: Empire_Invoke_PsExec
Repository: Neo23x0/signature-base
Detects: Detects Empire component - file Invoke-PsExec.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$s1 = "Invoke-PsExecCmd" fullword ascii
      $s2 = "\"[*] Executing service .EXE" fullword ascii
      $s3 = "$cmd = \"%COMSPEC% /C echo $Command ^> %systemroot%\\Temp\\" ascii

Detection condition:
( uint16(0) == 0x7566 and filesize < 50KB and 1 of them ) or all of them

Full rule:
rule Empire_Invoke_PsExec {
   meta:
      description = "Detects Empire component - file Invoke-PsExec.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "0218be4323959fc6379489a6a5e030bb9f1de672326e5e5b8844ab5cedfdcf88"
      id = "19aaec3e-3e8f-5d7d-9c70-a212756c0300"
   strings:
      $s1 = "Invoke-PsExecCmd" fullword ascii
      $s2 = "\"[*] Executing service .EXE" fullword ascii
      $s3 = "$cmd = \"%COMSPEC% /C echo $Command ^> %systemroot%\\Temp\\" ascii
   condition:
      ( uint16(0) == 0x7566 and filesize < 50KB and 1 of them ) or all of them
}
YARA Detection Rule: Empire_Invoke_PostExfil
Repository: Neo23x0/signature-base
Detects: Detects Empire component - file Invoke-PostExfil.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$s1 = "# upload to a specified exfil URI" fullword ascii
      $s2 = "Server path to exfil to." fullword ascii

Detection condition:
( uint16(0) == 0x490a and filesize < 2KB and 1 of them ) or all of them

Full rule:
rule Empire_Invoke_PostExfil {
   meta:
      description = "Detects Empire component - file Invoke-PostExfil.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "00c0479f83c3dbbeff42f4ab9b71ca5fe8cd5061cb37b7b6861c73c54fd96d3e"
      id = "58d9e057-efde-56ab-9b7e-982342a910e2"
   strings:
      $s1 = "# upload to a specified exfil URI" fullword ascii
      $s2 = "Server path to exfil to." fullword ascii
   condition:
      ( uint16(0) == 0x490a and filesize < 2KB and 1 of them ) or all of them
}
YARA Detection Rule: Empire_Invoke_SMBAutoBrute
Repository: Neo23x0/signature-base
Detects: Detects Empire component - file Invoke-SMBAutoBrute.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$s1 = "[*] PDC: LAB-2008-DC1.lab.com" fullword ascii
      $s2 = "$attempts = Get-UserBadPwdCount $userid $dcs" fullword ascii

Detection condition:
( uint16(0) == 0x7566 and filesize < 30KB and 1 of them ) or all of them

Full rule:
rule Empire_Invoke_SMBAutoBrute {
   meta:
      description = "Detects Empire component - file Invoke-SMBAutoBrute.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "7950f8abdd8ee09ed168137ef5380047d9d767a[PII_REDACTED]acc33b662f812b2"
      id = "a6b402ac-0925-5bc6-9d6a-b2b811496f9e"
   strings:
      $s1 = "[*] PDC: LAB-2008-DC1.lab.com" fullword ascii
      $s2 = "$attempts = Get-UserBadPwdCount $userid $dcs" fullword ascii
   condition:
      ( uint16(0) == 0x7566 and filesize < 30KB and 1 of them ) or all of them
}
YARA Detection Rule: Empire_Get_Keystrokes
Repository: Neo23x0/signature-base
Detects: Detects Empire component - file Get-Keystrokes.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$s1 = "$RightMouse   = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::RButton) -band 0x8000) -eq 0x8000" fullword ascii

Detection condition:
( uint16(0) == 0x7566 and filesize < 30KB and 1 of them ) or all of them

Full rule:
rule Empire_Get_Keystrokes {
   meta:
      description = "Detects Empire component - file Get-Keystrokes.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "c36e71db39f6852f78df1fa3f67e8c8a188bf951e96500911e9907ee895bf8ad"
      id = "7fb57a0d-6b65-5ee8-96ef-9af303f15007"
   strings:
      $s1 = "$RightMouse   = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::RButton) -band 0x8000) -eq 0x8000" fullword ascii
   condition:
      ( uint16(0) == 0x7566 and filesize < 30KB and 1 of them ) or all of them
}
YARA Detection Rule: Empire_Invoke_DllInjection
Repository: Neo23x0/signature-base
Detects: Detects Empire component - file Invoke-DllInjection.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$s1 = "-Dll evil.dll" fullword ascii

Detection condition:
( uint16(0) == 0x7566 and filesize < 40KB and 1 of them ) or all of them

Full rule:
rule Empire_Invoke_DllInjection {
   meta:
      description = "Detects Empire component - file Invoke-DllInjection.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "304031aa9eca5a83bdf1f654285d86df79cb3bba4aa8fe1eb680bd5b2878ebf0"
      id = "6aa14e8f-9801-5cd3-beb0-955e19d25503"
   strings:
      $s1 = "-Dll evil.dll" fullword ascii
   condition:
      ( uint16(0) == 0x7566 and filesize < 40KB and 1 of them ) or all of them
}
YARA Detection Rule: Empire_KeePassConfig
Repository: Neo23x0/signature-base
Detects: Detects Empire component - file KeePassConfig.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$s1 = "$UserMasterKeyFiles = @(, $(Get-ChildItem -Path $UserMasterKeyFolder -Force | Select-Object -ExpandProperty FullName) )" fullword ascii

Detection condition:
( uint16(0) == 0x7223 and filesize < 80KB and 1 of them ) or all of them

Full rule:
rule Empire_KeePassConfig {
   meta:
      description = "Detects Empire component - file KeePassConfig.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "5a76e642357792bb4270114d7cd76ce45ba24b0d741f5c6b916aeebd45cff2b3"
      id = "814a6ff9-a6ac-55e7-bb3f-597351ce421d"
   strings:
      $s1 = "$UserMasterKeyFiles = @(, $(Get-ChildItem -Path $UserMasterKeyFolder -Force | Select-Object -ExpandProperty FullName) )" fullword ascii
   condition:
      ( uint16(0) == 0x7223 and filesize < 80KB and 1 of them ) or all of them
}
YARA Detection Rule: Empire_Invoke_SSHCommand
Repository: Neo23x0/signature-base
Detects: Detects Empire component - file Invoke-SSHCommand.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$s1 = "$Base64 = 'TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAA" ascii
      $s2 = "Invoke-SSHCommand -ip 192.168.1.100 -Username root -Password test -Command \"id\"" fullword ascii
      $s3 = "Write-Verbose \"[*] Error loading dll\"" fullword ascii

Detection condition:
( uint16(0) == 0x660a and filesize < 2000KB and 1 of them ) or all of them

Full rule:
rule Empire_Invoke_SSHCommand {
   meta:
      description = "Detects Empire component - file Invoke-SSHCommand.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "cbaf086b14d5bb6a756cbda42943d4d7ef97f8277164ce1f7dd0a1843e9aa242"
      id = "b06b507f-b6b8-5f4b-8d6d-920f141e9ac1"
   strings:
      $s1 = "$Base64 = 'TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAA" ascii
      $s2 = "Invoke-SSHCommand -ip 192.168.1.100 -Username root -Password test -Command \"id\"" fullword ascii
      $s3 = "Write-Verbose \"[*] Error loading dll\"" fullword ascii
   condition:
      ( uint16(0) == 0x660a and filesize < 2000KB and 1 of them ) or all of them
}
YARA Detection Rule: Empire_PowerShell_Framework_Gen1
Repository: Neo23x0/signature-base
Detects: Detects Empire component
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$s1 = "Write-BytesToMemory -Bytes $Shellcode" ascii
      $s2 = "$GetCommandLineAAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineAAddrTemp ($Shellcode1.Length)" fullword ascii

Detection condition:
( uint16(0) == 0x7566 and filesize < 4000KB and 1 of them ) or all of them

Full rule:
rule Empire_PowerShell_Framework_Gen1 {
   meta:
      description = "Detects Empire component"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      super_rule = 1
      hash1 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
      hash2 = "a3428a7d4f9e677623fadff61b2a37d[PII_REDACTED]5755ab0f296aa3b0396eb28"
      hash3 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
      hash4 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
      hash5 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
      id = "8fdb48a0-5d40-55be-ae23-e9c8c4c2ecea"
   strings:
      $s1 = "Write-BytesToMemory -Bytes $Shellcode" ascii
      $s2 = "$GetCommandLineAAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineAAddrTemp ($Shellcode1.Length)" fullword ascii
   condition:
      ( uint16(0) == 0x7566 and filesize < 4000KB and 1 of them ) or all of them
}
YARA Detection Rule: Empire_PowerUp_Gen
Repository: Neo23x0/signature-base
Detects: Detects Empire component - from files PowerUp.ps1, PowerUp.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$s1 = "$Result = sc.exe config $($TargetService.Name) binPath= $OriginalPath" fullword ascii
      $s2 = "$Result = sc.exe pause $($TargetService.Name)" fullword ascii

Detection condition:
( uint16(0) == 0x233c and filesize < 2000KB and 1 of them ) or all of them

Full rule:
rule Empire_PowerUp_Gen {
   meta:
      description = "Detects Empire component - from files PowerUp.ps1, PowerUp.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      super_rule = 1
      hash1 = "ad9a5dff257828ba5f15331d59dd4def3989537b3b6375495d0c[PII_REDACTED]8c"
      id = "ae6b0462-7193-54a4-8fb9-befc1b461b15"
   strings:
      $s1 = "$Result = sc.exe config $($TargetService.Name) binPath= $OriginalPath" fullword ascii
      $s2 = "$Result = sc.exe pause $($TargetService.Name)" fullword ascii
   condition:
      ( uint16(0) == 0x233c and filesize < 2000KB and 1 of them ) or all of them
}