deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: blackhole2_htm10
Repository: Yara-Rules/rules
Detects: BlackHole2 Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "</body></html>"
   $string1 = "/icons/back.gif"
   $string2 = ">373K</td><td>"
   $string3 = "/icons/unknown.gif"
   $string4 = ">Last modified</a></th><th><a href"
   $string5 = "tmp.gz"
   $string6 = ">tmp.gz</a></td><td align"
   $string7 = "nbsp;</td><td align"
   $string8 = "</table>"
   $string9 = ">  - </td><td>"
   $string10 = ">filefdc7aaf4a3</a></td><td align"
   $string11 = ">19-Sep-2012 07:06  </td><td align"
   $string12 = "><img src"
   $string13 = "file3fa7bdd7dc"
   $string14 = "  <title>Index of /files</title>"
   $string15 = "0da49e042d"

Detection condition:
15 of them

Full rule:
rule blackhole2_htm10 : EK
{
meta:
   author = "Josh Berry"
   date = "2016-06-27"
   description = "BlackHole2 Exploit Kit Detection"
   hash0 = "83704d531c[PII_REDACTED]fec285675eb1"
   hash1 = "103ef0314607d28b3c54cd07e954cb25"
   hash2 = "16c002dc45976caae259d7cabc95b2c3"
   hash3 = "fd84d695ac3f2ebfb98d3255b3a4e1de"
   hash4 = "c7b417a4d650c72efebc2c45eefbac2a"
   hash5 = "c3c35e465e316a71abccca296ff6cd22"
   hash2 = "16c002dc45976caae259d7cabc95b2c3"
   hash7 = "10ce7956266bfd98fe310d7568bfc9d0"
   hash8 = "60024caf40f4239d7e796916fb52dc8c"
   sample_filetype = "js-html"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "</body></html>"
   $string1 = "/icons/back.gif"
   $string2 = ">373K</td><td>"
   $string3 = "/icons/unknown.gif"
   $string4 = ">Last modified</a></th><th><a href"
   $string5 = "tmp.gz"
   $string6 = ">tmp.gz</a></td><td align"
   $string7 = "nbsp;</td><td align"
   $string8 = "</table>"
   $string9 = ">  - </td><td>"
   $string10 = ">filefdc7aaf4a3</a></td><td align"
   $string11 = ">19-Sep-2012 07:06  </td><td align"
   $string12 = "><img src"
   $string13 = "file3fa7bdd7dc"
   $string14 = "  <title>Index of /files</title>"
   $string15 = "0da49e042d"
condition:
   15 of them
}
YARA Detection Rule: blackhole2_htm11
Repository: Yara-Rules/rules
Detects: BlackHole2 Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "></th><th><a href"
   $string1 = "/icons/back.gif"
   $string2 = ">Description</a></th></tr><tr><th colspan"
   $string3 = "nbsp;</td><td align"
   $string4 = "nbsp;</td></tr>"
   $string5 = ">  - </td><td>"
   $string6 = "-//W3C//DTD HTML 3.2 Final//EN"
   $string7 = "<h1>Index of /dummy</h1>"
   $string8 = ">Size</a></th><th><a href"
   $string9 = " </head>"
   $string10 = "/icons/blank.gif"
   $string11 = "><hr></th></tr>"

Detection condition:
11 of them

Full rule:
rule blackhole2_htm11 : EK
{
meta:
   author = "Josh Berry"
   date = "2016-06-27"
   description = "BlackHole2 Exploit Kit Detection"
   hash0 = "e89b56df597688c489f06a0a6dd9efed"
   hash1 = "06ba331ac5ae3cd1986c82cb1098029e"
   hash2 = "a899dedb50ad81d9dbba660747828c7b"
   hash3 = "7cbb[PII_REDACTED]7fe8b643204a046e2b"
   hash2 = "a899dedb50ad81d9dbba660747828c7b"
   hash0 = "e89b56df597688c489f06a0a6dd9efed"
   hash2 = "a899dedb50ad81d9dbba660747828c7b"
   hash7 = "530d31a0c45b79c1ee0c5c678e242c02"
   hash2 = "a899dedb50ad81d9dbba660747828c7b"
   sample_filetype = "js-html"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "></th><th><a href"
   $string1 = "/icons/back.gif"
   $string2 = ">Description</a></th></tr><tr><th colspan"
   $string3 = "nbsp;</td><td align"
   $string4 = "nbsp;</td></tr>"
   $string5 = ">  - </td><td>"
   $string6 = "-//W3C//DTD HTML 3.2 Final//EN"
   $string7 = "<h1>Index of /dummy</h1>"
   $string8 = ">Size</a></th><th><a href"
   $string9 = " </head>"
   $string10 = "/icons/blank.gif"
   $string11 = "><hr></th></tr>"
condition:
   11 of them
}
YARA Detection Rule: blackhole2_htm12
Repository: Yara-Rules/rules
Detects: BlackHole2 Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "  <title>Index of /data</title>"
   $string1 = "<tr><th colspan"
   $string2 = "</body></html>"
   $string3 = "> 20K</td><td>"
   $string4 = "/icons/layout.gif"
   $string5 = " <body>"
   $string6 = ">Name</a></th><th><a href"
   $string7 = ">spn.jar</a></td><td align"
   $string8 = ">spn2.jar</a></td><td align"
   $string9 = " <head>"
   $string10 = "-//W3C//DTD HTML 3.2 Final//EN"
   $string11 = "> 10K</td><td>"
   $string12 = ">7.9K</td><td>"
   $string13 = ">Size</a></th><th><a href"
   $string14 = "><hr></th></tr>"

Detection condition:
14 of them

Full rule:
rule blackhole2_htm12 : EK
{
meta:
   author = "Josh Berry"
   date = "2016-06-27"
   description = "BlackHole2 Exploit Kit Detection"
   hash0 = "0d3acb5285cfe071e30be051d2aaf28a"
   hash1 = "6f27377115ba5fd59f007d2cb3f50b35"
   hash2 = "f7ffe1fd1a57d337a04d3c777cddc065"
   hash3 = "06997228f2769859ef5e4cd8a454d650"
   hash4 = "11062eea9b7f2a2675c1e60047e8735c"
   hash0 = "0d3acb5285cfe071e30be051d2aaf28a"
   hash2 = "f7ffe1fd1a57d337a04d3c777cddc065"
   hash7 = "4ec720cfafabd1c9b1034bb82d368a30"
   hash8 = "ecd7d11dc9bb6ee842e2a2dce56edc6f"
   sample_filetype = "js-html"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "  <title>Index of /data</title>"
   $string1 = "<tr><th colspan"
   $string2 = "</body></html>"
   $string3 = "> 20K</td><td>"
   $string4 = "/icons/layout.gif"
   $string5 = " <body>"
   $string6 = ">Name</a></th><th><a href"
   $string7 = ">spn.jar</a></td><td align"
   $string8 = ">spn2.jar</a></td><td align"
   $string9 = " <head>"
   $string10 = "-//W3C//DTD HTML 3.2 Final//EN"
   $string11 = "> 10K</td><td>"
   $string12 = ">7.9K</td><td>"
   $string13 = ">Size</a></th><th><a href"
   $string14 = "><hr></th></tr>"
condition:
   14 of them
}
YARA Detection Rule: blackhole2_htm3
Repository: Yara-Rules/rules
Detects: BlackHole2 Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "/download.php"
   $string1 = "./files/fdc7aaf4a3 md5 is 3169969e91f5fe5446909bbab6e14d5d"
   $string2 = "321e774d81b2c3ae"
   $string3 = "/files/new00010/554-0002.exe md5 is 8a497cf4ffa8a173a7ac75f0de1f8d8b"
   $string4 = "./files/3fa7bdd7dc md5 is 8a497cf4ffa8a173a7ac75f0de1f8d8b"
   $string5 = "[PII_REDACTED]30120915 md5 is 425ebdfcf03045917d90878d264773d2"

Detection condition:
3 of them

Full rule:
rule blackhole2_htm3 : EK
{
meta:
   author = "Josh Berry"
   date = "2016-06-27"
   description = "BlackHole2 Exploit Kit Detection"
   hash0 = "018ef031bc68484587eafeefa66c7082"
   sample_filetype = "js-html"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "/download.php"
   $string1 = "./files/fdc7aaf4a3 md5 is 3169969e91f5fe5446909bbab6e14d5d"
   $string2 = "321e774d81b2c3ae"
   $string3 = "/files/new00010/554-0002.exe md5 is 8a497cf4ffa8a173a7ac75f0de1f8d8b"
   $string4 = "./files/3fa7bdd7dc md5 is 8a497cf4ffa8a173a7ac75f0de1f8d8b"
   $string5 = "[PII_REDACTED]30120915 md5 is 425ebdfcf03045917d90878d264773d2"
condition:
   3 of them
}
YARA Detection Rule: blackhole2_htm4
Repository: Yara-Rules/rules
Detects: BlackHole2 Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "words.dat"
   $string1 = "/icons/back.gif"
   $string2 = "data.dat"
   $string3 = "files.php"
   $string4 = "js.php"
   $string5 = "template.php"
   $string6 = "kcaptcha"
   $string7 = "/icons/blank.gif"
   $string8 = "java.dat"

Detection condition:
8 of them

Full rule:
rule blackhole2_htm4 : EK
{
meta:
   author = "Josh Berry"
   date = "2016-06-27"
   description = "BlackHole2 Exploit Kit Detection"
   hash0 = "926429bf5fe1fbd531eb100fc6e53524"
   hash1 = "7b6cdc67077fc3ca75a54dea0833afe3"
   hash2 = "82f108d4e6f997f8fc4cc02aad02629a"
   hash3 = "bd819c3714dffb5d4988d2f19d571918"
   hash4 = "9bc9f925f60bd8a7b632ae3a6147cb9e"
   hash0 = "926429bf5fe1fbd531eb100fc6e53524"
   hash2 = "82f108d4e6f997f8fc4cc02aad02629a"
   hash7 = "386cb76d46b281778c8c54ac001d72dc"
   hash8 = "0d95c666ea5d5c28fca5381bd54304b3"
   sample_filetype = "js-html"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "words.dat"
   $string1 = "/icons/back.gif"
   $string2 = "data.dat"
   $string3 = "files.php"
   $string4 = "js.php"
   $string5 = "template.php"
   $string6 = "kcaptcha"
   $string7 = "/icons/blank.gif"
   $string8 = "java.dat"
condition:
   8 of them
}
YARA Detection Rule: blackhole2_htm5
Repository: Yara-Rules/rules
Detects: BlackHole2 Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "ruleEdit.php"
   $string1 = "domains.php"
   $string2 = "menu.php"
   $string3 = "browsers_stat.php"
   $string4 = "Index of /library/templates"
   $string5 = "/icons/unknown.gif"
   $string6 = "browsers_bstat.php"
   $string7 = "oses_stat.php"
   $string8 = "exploits_bstat.php"
   $string9 = "block_config.php"
   $string10 = "threads_bstat.php"
   $string11 = "browsers_bstat.php"
   $string12 = "settings.php"

Detection condition:
12 of them

Full rule:
rule blackhole2_htm5 : EK
{
meta:
   author = "Josh Berry"
   date = "2016-06-27"
   description = "BlackHole2 Exploit Kit Detection"
   hash0 = "fccb8f71663620a5a8b53dcfb396cfb5"
   hash1 = "a09bcf1a1bdabe4e6e7e52e7f8898012"
   hash2 = "40db66bf212dd953a169752ba9349c6a"
   hash3 = "25a87e6da4baa57a9d6a2cdcb2d43249"
   hash4 = "6f4c64a1293c03c9f881a4ef4e1491b3"
   hash0 = "fccb8f71663620a5a8b53dcfb396cfb5"
   hash2 = "40db66bf212dd953a169752ba9349c6a"
   hash7 = "4bdfff8de0bb5ea2d623333a4a82c7f9"
   hash8 = "b43b6a1897c2956c2a0c9407b74c4232"
   sample_filetype = "js-html"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "ruleEdit.php"
   $string1 = "domains.php"
   $string2 = "menu.php"
   $string3 = "browsers_stat.php"
   $string4 = "Index of /library/templates"
   $string5 = "/icons/unknown.gif"
   $string6 = "browsers_bstat.php"
   $string7 = "oses_stat.php"
   $string8 = "exploits_bstat.php"
   $string9 = "block_config.php"
   $string10 = "threads_bstat.php"
   $string11 = "browsers_bstat.php"
   $string12 = "settings.php"
condition:
   12 of them
}
YARA Detection Rule: blackhole2_htm6
Repository: Yara-Rules/rules
Detects: BlackHole2 Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "uniq1.png"
   $string1 = "edit.png"
   $string2 = "left.gif"
   $string3 = "infin.png"
   $string4 = "outdent.gif"
   $string5 = "exploit.gif"
   $string6 = "sem_g.png"
   $string7 = "Index of /library/templates/img"
   $string8 = "uniq1.png"

Detection condition:
8 of them

Full rule:
rule blackhole2_htm6 : EK
{
meta:
   author = "Josh Berry"
   date = "2016-06-27"
   description = "BlackHole2 Exploit Kit Detection"
   hash0 = "a5f94d7bdeb88b57be67132473e48286"
   hash1 = "2e72a317d07aa1603f8d138787a2c582"
   hash2 = "9440d49e1ed0794c90547758ef6023f7"
   hash3 = "58265fc893ed5a001e3a7c925441298c"
   hash2 = "9440d49e1ed0794c90547758ef6023f7"
   hash0 = "a5f94d7bdeb88b57be67132473e48286"
   hash2 = "9440d49e1ed0794c90547758ef6023f7"
   hash7 = "95c6462d0f21181c5003e2a74c8d3529"
   hash8 = "9236e7f96207253b4684f3497bcd2b3d"
   sample_filetype = "js-html"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "uniq1.png"
   $string1 = "edit.png"
   $string2 = "left.gif"
   $string3 = "infin.png"
   $string4 = "outdent.gif"
   $string5 = "exploit.gif"
   $string6 = "sem_g.png"
   $string7 = "Index of /library/templates/img"
   $string8 = "uniq1.png"
condition:
   8 of them
}
YARA Detection Rule: blackhole2_htm8
Repository: Yara-Rules/rules
Detects: BlackHole2 Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = ">Description</a></th></tr><tr><th colspan"
   $string1 = ">Name</a></th><th><a href"
   $string2 = "main.js"
   $string3 = "datepicker.js"
   $string4 = "form.js"
   $string5 = "<address>Apache/2.2.15 (CentOS) Server at online-moo-viii.net Port 80</address>"
   $string6 = "wysiwyg.js"

Detection condition:
6 of them

Full rule:
rule blackhole2_htm8 : EK
{
meta:
   author = "Josh Berry"
   date = "2016-06-27"
   description = "BlackHole2 Exploit Kit Detection"
   hash0 = "3f47452c1e40f68160beff4bb2a3e5f4"
   hash1 = "1e2ba[PII_REDACTED]e3580dfce0245bc16"
   hash2 = "1c78d96bb8d8f8a71294bc1e6d374b0f"
   hash3 = "f5e16a6cd2c2ac71289aaf1c087224ee"
   hash2 = "1c78d96bb8d8f8a71294bc1e6d374b0f"
   hash0 = "3f47452c1e40f68160beff4bb2a3e5f4"
   hash2 = "1c78d96bb8d8f8a71294bc1e6d374b0f"
   hash7 = "6702efdee17e0cd6c[PII_REDACTED]1d9fa"
   hash8 = "287dca9469c8f7f0cb6e5bdd9e2055cd"
   sample_filetype = "js-html"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = ">Description</a></th></tr><tr><th colspan"
   $string1 = ">Name</a></th><th><a href"
   $string2 = "main.js"
   $string3 = "datepicker.js"
   $string4 = "form.js"
   $string5 = "<address>Apache/2.2.15 (CentOS) Server at online-moo-viii.net Port 80</address>"
   $string6 = "wysiwyg.js"
condition:
   6 of them
}
YARA Detection Rule: zeus_js
Repository: Yara-Rules/rules
Detects: Zeus Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "var jsmLastMenu "
	$string1 = "position:absolute; z-index:99' "
	$string2 = " -1)jsmSetDisplayStyle('popupmenu' "
	$string3 = " '<tr><td><a href"
	$string4 = "  jsmLastMenu "
	$string5 = "  var ids "
	$string6 = "this.target"
	$string7 = " jsmPrevMenu, 'none');"
	$string8 = "  if(jsmPrevMenu "
	$string9 = ")if(MenuData[i])"
	$string10 = " '<div style"
	$string11 = "popupmenu"
	$string12 = "  jsmSetDisplayStyle('popupmenu' "
	$string13 = "function jsmHideLastMenu()"
	$string14 = " MenuData.length; i"

Detection condition:
14 of them

Full rule:
rule zeus_js : EK
{
meta:
	author = "Josh Berry"
	date = "2016-06-26"
	description = "Zeus Exploit Kit Detection"
	hash0 = "c87ac7a25168df49a64564afb04dc961"
	sample_filetype = "js-html"
	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
	$string0 = "var jsmLastMenu "
	$string1 = "position:absolute; z-index:99' "
	$string2 = " -1)jsmSetDisplayStyle('popupmenu' "
	$string3 = " '<tr><td><a href"
	$string4 = "  jsmLastMenu "
	$string5 = "  var ids "
	$string6 = "this.target"
	$string7 = " jsmPrevMenu, 'none');"
	$string8 = "  if(jsmPrevMenu "
	$string9 = ")if(MenuData[i])"
	$string10 = " '<div style"
	$string11 = "popupmenu"
	$string12 = "  jsmSetDisplayStyle('popupmenu' "
	$string13 = "function jsmHideLastMenu()"
	$string14 = " MenuData.length; i"
condition:
	14 of them
}
YARA Detection Rule: WindowsPE
Repository: Yara-Rules/rules

Detection condition:
uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550

Full rule:
private rule WindowsPE
{
    condition:
        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550
}
YARA Detection Rule: DebuggerCheck__PEB
Repository: Yara-Rules/rules
Author: naxonez
Reference: https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Pattern signatures:
$ ="IsDebugged"

Detection condition:
any of them

Full rule:
rule DebuggerCheck__PEB : AntiDebug DebuggerCheck {
	meta:
		weight = 1
		Author = "naxonez"
		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
	strings:
		$ ="IsDebugged"
	condition:
		any of them
}
YARA Detection Rule: DebuggerCheck__GlobalFlags
Repository: Yara-Rules/rules
Author: naxonez
Reference: https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Pattern signatures:
$ ="NtGlobalFlags"

Detection condition:
any of them

Full rule:
rule DebuggerCheck__GlobalFlags : AntiDebug DebuggerCheck {
	meta:
		weight = 1
		Author = "naxonez"
		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
	strings:
		$ ="NtGlobalFlags"
	condition:
		any of them
}
YARA Detection Rule: DebuggerCheck__QueryInfo
Repository: Yara-Rules/rules
Author: naxonez
Reference: https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Pattern signatures:
$ ="QueryInformationProcess"

Detection condition:
any of them

Full rule:
rule DebuggerCheck__QueryInfo : AntiDebug DebuggerCheck {
	meta:
		weight = 1
		Author = "naxonez"
		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
	strings:
		$ ="QueryInformationProcess"
	condition:
		any of them
}
YARA Detection Rule: DebuggerCheck__RemoteAPI
Repository: Yara-Rules/rules
Author: naxonez
Reference: https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Pattern signatures:
$ ="CheckRemoteDebuggerPresent"

Detection condition:
any of them

Full rule:
rule DebuggerCheck__RemoteAPI : AntiDebug DebuggerCheck {
	meta:
		weight = 1
		Author = "naxonez"
		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
	strings:
		$ ="CheckRemoteDebuggerPresent"
	condition:
		any of them
}
YARA Detection Rule: DebuggerHiding__Thread
Repository: Yara-Rules/rules
Author: naxonez
Reference: https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Pattern signatures:
$ ="SetInformationThread"

Detection condition:
any of them

Full rule:
rule DebuggerHiding__Thread : AntiDebug DebuggerHiding {
	meta:
	    Author = "naxonez"
		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
		weight = 1
	strings:
		$ ="SetInformationThread"
	condition:
		any of them
}
YARA Detection Rule: DebuggerHiding__Active
Repository: Yara-Rules/rules
Author: naxonez
Reference: https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Pattern signatures:
$ ="DebugActiveProcess"

Detection condition:
any of them

Full rule:
rule DebuggerHiding__Active : AntiDebug DebuggerHiding {
	meta:
		weight = 1
		Author = "naxonez"
		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
	strings:
		$ ="DebugActiveProcess"
	condition:
		any of them
}
YARA Detection Rule: DebuggerTiming__PerformanceCounter
Repository: Yara-Rules/rules
Author: naxonez
Reference: https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Pattern signatures:
$ ="QueryPerformanceCounter"

Detection condition:
any of them

Full rule:
rule DebuggerTiming__PerformanceCounter : AntiDebug DebuggerTiming {
	meta:
		weight = 1
		Author = "naxonez"
		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
	strings:
		$ ="QueryPerformanceCounter"
	condition:
		any of them
}
YARA Detection Rule: DebuggerTiming__Ticks
Repository: Yara-Rules/rules
Author: naxonez
Reference: https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Pattern signatures:
$ ="GetTickCount"

Detection condition:
any of them

Full rule:
rule DebuggerTiming__Ticks : AntiDebug DebuggerTiming {
	meta:
		weight = 1
		Author = "naxonez"
		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
	strings:
		$ ="GetTickCount"
	condition:
		any of them
}
YARA Detection Rule: DebuggerOutput__String
Repository: Yara-Rules/rules
Author: naxonez
Reference: https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Pattern signatures:
$ ="OutputDebugString"

Detection condition:
any of them

Full rule:
rule DebuggerOutput__String : AntiDebug DebuggerOutput {
	meta:
		weight = 1
		Author = "naxonez"
		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
	strings:
		$ ="OutputDebugString"
	condition:
		any of them
}
YARA Detection Rule: DebuggerException__UnhandledFilter
Repository: Yara-Rules/rules
Author: naxonez
Reference: https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Pattern signatures:
$ ="SetUnhandledExceptionFilter"

Detection condition:
any of them

Full rule:
rule DebuggerException__UnhandledFilter : AntiDebug DebuggerException {
	meta:
		weight = 1
		Author = "naxonez"
		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
	strings:
		$ ="SetUnhandledExceptionFilter"
	condition:
		any of them
}
YARA Detection Rule: DebuggerException__ConsoleCtrl
Repository: Yara-Rules/rules
Author: naxonez
Reference: https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Pattern signatures:
$ ="GenerateConsoleCtrlEvent"

Detection condition:
any of them

Full rule:
rule DebuggerException__ConsoleCtrl : AntiDebug DebuggerException {
	meta:
		weight = 1
		Author = "naxonez"
		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
	strings:
		$ ="GenerateConsoleCtrlEvent"
	condition:
		any of them
}
YARA Detection Rule: DebuggerException__SetConsoleCtrl
Repository: Yara-Rules/rules
Author: naxonez
Reference: https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Pattern signatures:
$ ="SetConsoleCtrlHandler"

Detection condition:
any of them

Full rule:
rule DebuggerException__SetConsoleCtrl : AntiDebug DebuggerException {
	meta:
		weight = 1
		Author = "naxonez"
		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
	strings:
		$ ="SetConsoleCtrlHandler"
	condition:
		any of them
}
YARA Detection Rule: ThreadControl__Context
Repository: Yara-Rules/rules
Author: naxonez
Reference: https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Pattern signatures:
$ ="SetThreadContext"

Detection condition:
any of them

Full rule:
rule ThreadControl__Context : AntiDebug ThreadControl {
	meta:
		weight = 1
		Author = "naxonez"
		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
	strings:
		$ ="SetThreadContext"
	condition:
		any of them
}
YARA Detection Rule: DebuggerCheck__DrWatson
Repository: Yara-Rules/rules
Author: naxonez
Reference: https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Pattern signatures:
$ ="__invoke__watson"

Detection condition:
any of them

Full rule:
rule DebuggerCheck__DrWatson : AntiDebug DebuggerCheck {
	meta:
		weight = 1
		Author = "naxonez"
		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
	strings:
		$ ="__invoke__watson"
	condition:
		any of them
}
YARA Detection Rule: SEH__v3
Repository: Yara-Rules/rules
Author: naxonez
Reference: https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Pattern signatures:
$ = "____except__handler3"
		$ = "____local__unwind3"

Detection condition:
any of them

Full rule:
rule SEH__v3 : AntiDebug SEH {
	meta:
		weight = 1
		Author = "naxonez"
		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
	strings:
		$ = "____except__handler3"
		$ = "____local__unwind3"
	condition:
		any of them
}
YARA Detection Rule: SEH__v4
Repository: Yara-Rules/rules
Author: naxonez
Reference: https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Pattern signatures:
$ = "____except__handler4"
		$ = "____local__unwind4"
		$ = "__XcptFilter"

Detection condition:
any of them

Full rule:
rule SEH__v4 : AntiDebug SEH {
    // VS 8.0+
	meta:
		weight = 1
		Author = "naxonez"
		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
	strings:
		$ = "____except__handler4"
		$ = "____local__unwind4"
		$ = "__XcptFilter"
	condition:
		any of them
}
YARA Detection Rule: SEH__vba
Repository: Yara-Rules/rules
Author: naxonez
Reference: https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Pattern signatures:
$ = "vbaExceptHandler"

Detection condition:
any of them

Full rule:
rule SEH__vba : AntiDebug SEH {
	meta:
		weight = 1
		Author = "naxonez"
		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
	strings:
		$ = "vbaExceptHandler"
	condition:
		any of them
}
YARA Detection Rule: SEH__vectored
Repository: Yara-Rules/rules
Author: naxonez
Reference: https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Pattern signatures:
$ = "AddVectoredExceptionHandler"
		$ = "RemoveVectoredExceptionHandler"

Detection condition:
any of them

Full rule:
rule SEH__vectored : AntiDebug SEH {
	meta:
		weight = 1
		Author = "naxonez"
		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
	strings:
		$ = "AddVectoredExceptionHandler"
		$ = "RemoveVectoredExceptionHandler"
	condition:
		any of them
}