deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Empire_Invoke_Mimikatz
Repository: Neo23x0/signature-base
Detects: Empire - a pure PowerShell post-exploitation agent - file Invoke-Mimikatz.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/PowerShellEmpire/Empire

Pattern signatures:
$s1 = "$PEBytes64 = \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwc" ascii 
		$s2 = "[System.Runtime.InteropServices.Marshal]::StructureToPtr($CmdLineAArgsPtr, $GetCommandLineAAddrTemp, $false)" fullword ascii 
		$s3 = "Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $GetCommandLineWAddrTemp" fullword ascii

Detection condition:
filesize < 2500KB and 2 of them

Full rule:
rule Empire_Invoke_Mimikatz {
	meta:
		description = "Empire - a pure PowerShell post-exploitation agent - file Invoke-Mimikatz.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/PowerShellEmpire/Empire"
		date = "2015-08-06"
		score = 70
		hash = "c5481864b757837ecbc75997fa24978ffde3672b8a144a55478ba9a864a19466"
		id = "f7d6c1c4-2a24-54fd-b745-32d7894affc8"
	strings:
		$s1 = "$PEBytes64 = \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwc" ascii 
		$s2 = "[System.Runtime.InteropServices.Marshal]::StructureToPtr($CmdLineAArgsPtr, $GetCommandLineAAddrTemp, $false)" fullword ascii 
		$s3 = "Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $GetCommandLineWAddrTemp" fullword ascii 
	condition:
		filesize < 2500KB and 2 of them
}
YARA Detection Rule: Empire_lib_modules_credentials_mimikatz_pth
Repository: Neo23x0/signature-base
Detects: Empire - a pure PowerShell post-exploitation agent - file pth.py
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/PowerShellEmpire/Empire

Pattern signatures:
$s0 = "(credID, credType, domainName, userName, password, host, sid, notes) = self.mainMenu.credentials.get_credentials(credID)[0]" fullword ascii 
		$s1 = "command = \"sekurlsa::pth /user:\"+self.options[\"user\"]['Value']" fullword ascii

Detection condition:
filesize < 12KB and all of them

Full rule:
rule Empire_lib_modules_credentials_mimikatz_pth {
	meta:
		description = "Empire - a pure PowerShell post-exploitation agent - file pth.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/PowerShellEmpire/Empire"
		date = "2015-08-06"
		score = 70
		hash = "6dee1cf931e02c5f3dc6889e879cc193325b39e18409dcdaf987b8bf7c459211"
		id = "f954b7e8-e820-5111-ba8d-a9b9779381b0"
	strings:
		$s0 = "(credID, credType, domainName, userName, password, host, sid, notes) = self.mainMenu.credentials.get_credentials(credID)[0]" fullword ascii 
		$s1 = "command = \"sekurlsa::pth /user:\"+self.options[\"user\"]['Value']" fullword ascii 
	condition:
		filesize < 12KB and all of them
}
YARA Detection Rule: Empire_Write_HijackDll
Repository: Neo23x0/signature-base
Detects: Empire - a pure PowerShell post-exploitation agent - file Write-HijackDll.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/PowerShellEmpire/Empire

Pattern signatures:
$s1 = "$DllBytes = Invoke-PatchDll -DllBytes $DllBytes -FindString \"debug.bat\" -ReplaceString $BatchPath" fullword ascii 
		$s2 = "$DllBytes32 = \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4AAAAA4fug4AtAnNIbgBTM0hVGhpcyBw" ascii 
		$s3 = "[Byte[]]$DllBytes = [Byte[]][Convert]::FromBase64String($DllBytes32)" fullword ascii

Detection condition:
filesize < 500KB and 2 of them

Full rule:
rule Empire_Write_HijackDll {
	meta:
		description = "Empire - a pure PowerShell post-exploitation agent - file Write-HijackDll.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/PowerShellEmpire/Empire"
		date = "2015-08-06"
		score = 70
		hash = "155fa7168e28f15bb34f67344f47234a866e2c63b3303422ff977540623c70bf"
		id = "6a80af21-fb01-5996-b14d-44ff55b7fb3e"
	strings:
		$s1 = "$DllBytes = Invoke-PatchDll -DllBytes $DllBytes -FindString \"debug.bat\" -ReplaceString $BatchPath" fullword ascii 
		$s2 = "$DllBytes32 = \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4AAAAA4fug4AtAnNIbgBTM0hVGhpcyBw" ascii 
		$s3 = "[Byte[]]$DllBytes = [Byte[]][Convert]::FromBase64String($DllBytes32)" fullword ascii 
	condition:
		filesize < 500KB and 2 of them
}
YARA Detection Rule: Empire_skeleton_key
Repository: Neo23x0/signature-base
Detects: Empire - a pure PowerShell post-exploitation agent - file skeleton_key.py
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/PowerShellEmpire/Empire

Pattern signatures:
$s1 = "script += \"Invoke-Mimikatz -Command '\\\"\" + command + \"\\\"';\"" fullword ascii 
		$s2 = "script += '\"Skeleton key implanted. Use password \\'mimikatz\\' for access.\"'" fullword ascii 
		$s3 = "command = \"misc::skeleton\"" fullword ascii 
		$s4 = "\"ONLY APPLICABLE ON DOMAIN CONTROLLERS!\")," fullword ascii

Detection condition:
filesize < 6KB and 2 of them

Full rule:
rule Empire_skeleton_key {
	meta:
		description = "Empire - a pure PowerShell post-exploitation agent - file skeleton_key.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/PowerShellEmpire/Empire"
		date = "2015-08-06"
		score = 70
		hash = "3d02f16dcc38faaf5e97e4c5dbddf761f[PII_REDACTED]e6af8826cde9e29bb750f"
		id = "d508e09e-13e8-5866-bb5b-0d886f960bb5"
	strings:
		$s1 = "script += \"Invoke-Mimikatz -Command '\\\"\" + command + \"\\\"';\"" fullword ascii 
		$s2 = "script += '\"Skeleton key implanted. Use password \\'mimikatz\\' for access.\"'" fullword ascii 
		$s3 = "command = \"misc::skeleton\"" fullword ascii 
		$s4 = "\"ONLY APPLICABLE ON DOMAIN CONTROLLERS!\")," fullword ascii 
	condition:
		filesize < 6KB and 2 of them
}
YARA Detection Rule: Empire_invoke_wmi
Repository: Neo23x0/signature-base
Detects: Empire - a pure PowerShell post-exploitation agent - file invoke_wmi.py
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/PowerShellEmpire/Empire

Pattern signatures:
$s1 = "(credID, credType, domainName, userName, password, host, sid, notes) = self.mainMenu.credentials.get_credentials(credID)[0]" fullword ascii 
		$s2 = "script += \";'Invoke-Wmi executed on \" +computerNames +\"'\"" fullword ascii 
		$s3 = "script = \"$PSPassword = \\\"\"+password+\"\\\" | ConvertTo-SecureString -asPlainText -Force;$Credential = New-Object System.Man" ascii

Detection condition:
filesize < 20KB and 2 of them

Full rule:
rule Empire_invoke_wmi {
	meta:
		description = "Empire - a pure PowerShell post-exploitation agent - file invoke_wmi.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/PowerShellEmpire/Empire"
		date = "2015-08-06"
		score = 70
		hash = "a914cb227f652734a91d3d39745ceeacaef7a8b5e89c1beedfd6d5f9b4615a1d"
		id = "1e1d1e71-6ea9-500a-b8b8-c48a64bc2b54"
	strings:
		$s1 = "(credID, credType, domainName, userName, password, host, sid, notes) = self.mainMenu.credentials.get_credentials(credID)[0]" fullword ascii 
		$s2 = "script += \";'Invoke-Wmi executed on \" +computerNames +\"'\"" fullword ascii 
		$s3 = "script = \"$PSPassword = \\\"\"+password+\"\\\" | ConvertTo-SecureString -asPlainText -Force;$Credential = New-Object System.Man" ascii 
	condition:
		filesize < 20KB and 2 of them
}
YARA Detection Rule: WEBSHELL_JAVA_VersaMem_JAR_Aug24_1
Repository: Neo23x0/signature-base
Detects: Detects VersaMem Java webshell samples (as used by Volt Typhoon)
Author: blacklotuslabs (modified by Florian Roth and X__Junior)
Reference: https://x.com/ryanaraine/status/[PII_REDACTED]15999117

Pattern signatures:
$sa1 = "com.versa.vnms.ui.TestMain"
      $sa2 = "captureLoginPasswordCode"
      $sa3 = "com/versa/vnms/ui/services/impl/VersaAuthenticationServiceImpl"
      $sa4 = "/tmp/.temp.data"
      $sa5 = "getInsertCode"
      $sa6 = "VersaMem"
      $sa7 = "Versa-Auth"

      $sb1 = "/tmp/.java_pid"
      $sb2 = {2f 75 73 72 2f 62 69 6e 2f 70 67 72 65 70 01 00 02 2d 66 01 00 25 6f 72 67 2e 61 70 61 63 68 65 2e 63 61 74 61 6c 69 6e 61 2e 73 74 61 72 74 75 70 2e 42 6f 6f 74 73 74 72 61 70 07}

Detection condition:
filesize < 5MB and ( 3 of them or all of ($sb*) )

Full rule:
rule WEBSHELL_JAVA_VersaMem_JAR_Aug24_1 {
   meta:
      description = "Detects VersaMem Java webshell samples (as used by Volt Typhoon)"
      author = "blacklotuslabs (modified by Florian Roth and X__Junior)"
      reference = "https://x.com/ryanaraine/status/[PII_REDACTED]15999117"
      date = "2024-08-27"
      modified = "2024-08-29"
      score = 75
      id = "9b666e61-cfa8-58b3-a362-772cd907c57c"
   strings:
      $sa1 = "com.versa.vnms.ui.TestMain"
      $sa2 = "captureLoginPasswordCode"
      $sa3 = "com/versa/vnms/ui/services/impl/VersaAuthenticationServiceImpl"
      $sa4 = "/tmp/.temp.data"
      $sa5 = "getInsertCode"
      $sa6 = "VersaMem"
      $sa7 = "Versa-Auth"

      $sb1 = "/tmp/.java_pid"
      $sb2 = {2f 75 73 72 2f 62 69 6e 2f 70 67 72 65 70 01 00 02 2d 66 01 00 25 6f 72 67 2e 61 70 61 63 68 65 2e 63 61 74 61 6c 69 6e 61 2e 73 74 61 72 74 75 70 2e 42 6f 6f 74 73 74 72 61 70 07}
   condition:
      filesize < 5MB and ( 3 of them or all of ($sb*) )
}
YARA Detection Rule: WEBSHELL_JAVA_VersaMem_JAR_Aug24_2
Repository: Neo23x0/signature-base
Detects: Detects VersaMem Java webshell samples (as used by Volt Typhoon)
Author: Florian Roth
Reference: https://x.com/craiu/status/[PII_REDACTED]84336990

Pattern signatures:
$x1 = "tomcat_memShell" ascii
      $x2 = "versa/vnms/ui/config/" ascii fullword

Detection condition:
uint16(0) == 0x4b50
      and filesize < 3000KB
      and 1 of them

Full rule:
rule WEBSHELL_JAVA_VersaMem_JAR_Aug24_2 {
   meta:
      description = "Detects VersaMem Java webshell samples (as used by Volt Typhoon)"
      author = "Florian Roth"
      reference = "https://x.com/craiu/status/[PII_REDACTED]84336990"
      date = "2024-08-29"
      score = 75
      hash1 = "4bcedac20a75e8f8833f4725adfc87577c32990c3783bf6c743f14599a176c37"
      id = "5ca598ed-5d0a-563d-a5e8-f8229af2c949"
   strings:
      $x1 = "tomcat_memShell" ascii
      $x2 = "versa/vnms/ui/config/" ascii fullword
   condition:
      uint16(0) == 0x4b50
      and filesize < 3000KB
      and 1 of them
}
YARA Detection Rule: WEBSHELL_ASP_Embedded_Mar21_1
Repository: Neo23x0/signature-base
Detects: Detects ASP webshells
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "<script runat=\"server\">" nocase
      $s2 = "new System.IO.StreamWriter(Request.Form["
      $s3 = ".Write(Request.Form["

Detection condition:
filesize < 100KB and all of them

Full rule:
rule WEBSHELL_ASP_Embedded_Mar21_1 {
   meta:
      description = "Detects ASP webshells"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2021-03-05"
      score = 85
      id = "7cf7db9d-8f8a-51db-a0e6-84748e8f9e1f"
   strings:
      $s1 = "<script runat=\"server\">" nocase
      $s2 = "new System.IO.StreamWriter(Request.Form["
      $s3 = ".Write(Request.Form["
   condition:
      filesize < 100KB and all of them
}
YARA Detection Rule: APT_WEBSHELL_HAFNIUM_SecChecker_Mar21_1
Repository: Neo23x0/signature-base
Detects: Detects HAFNIUM SecChecker webshell
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/markus_neis/status/[PII_REDACTED]37667840

Pattern signatures:
$x1 = "<%if(System.IO.File.Exists(\"c:\\\\program files (x86)\\\\fireeye\\\\xagt.exe" ascii
      $x2 = "\\csfalconservice.exe\")){Response.Write( \"3\");}%></head>" ascii fullword

Detection condition:
uint16(0) == 0x253c and
      filesize < 1KB and
      1 of them or 2 of them

Full rule:
rule APT_WEBSHELL_HAFNIUM_SecChecker_Mar21_1 {
   meta:
      description = "Detects HAFNIUM SecChecker webshell"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/markus_neis/status/[PII_REDACTED]37667840"
      date = "2021-03-05"
      hash1 = "b75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0"
      id = "73db3d78-7ece-53be-9efb-d19801993d5e"
   strings:
      $x1 = "<%if(System.IO.File.Exists(\"c:\\\\program files (x86)\\\\fireeye\\\\xagt.exe" ascii
      $x2 = "\\csfalconservice.exe\")){Response.Write( \"3\");}%></head>" ascii fullword
   condition:
      uint16(0) == 0x253c and
      filesize < 1KB and
      1 of them or 2 of them
}
YARA Detection Rule: APT_HAFNIUM_Forensic_Artefacts_Mar21_1
Repository: Neo23x0/signature-base
Detects: Detects forensic artefacts found in HAFNIUM intrusions
Author: Florian Roth (Nextron Systems)
Reference: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

Pattern signatures:
$s1 = "lsass.exe C:\\windows\\temp\\lsass" ascii wide fullword
      $s2 = "c:\\ProgramData\\it.zip" ascii wide fullword
      $s3 = "powercat.ps1'); powercat -c" ascii wide fullword

Detection condition:
1 of them

Full rule:
rule APT_HAFNIUM_Forensic_Artefacts_Mar21_1 {
   meta:
      description = "Detects forensic artefacts found in HAFNIUM intrusions"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
      date = "2021-03-02"
      id = "872822b0-34d9-5ae4-a532-6a8786494fa9"
   strings:
      $s1 = "lsass.exe C:\\windows\\temp\\lsass" ascii wide fullword
      $s2 = "c:\\ProgramData\\it.zip" ascii wide fullword
      $s3 = "powercat.ps1'); powercat -c" ascii wide fullword
   condition:
      1 of them
}
YARA Detection Rule: APT_WEBSHELL_HAFNIUM_Chopper_WebShell
Repository: Neo23x0/signature-base
Detects: Detects Chopper WebShell Injection Variant (not only Hafnium related)
Author: Markus Neis,Swisscom
Reference: https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/

Pattern signatures:
$x1 = "runat=\"server\">" nocase

      $s1 = "<script language=\"JScript\" runat=\"server\">function Page_Load(){eval(Request" nocase
      $s2 = "protected void Page_Load(object sender, EventArgs e){System.IO.StreamWriter sw = new System.IO.StreamWriter(Request.Form[\"p\"] , false, Encoding.Default);sw.Write(Request.Form[\"f\"]);"
      $s3 = "<script language=\"JScript\" runat=\"server\"> function Page_Load(){eval (Request[\"" nocase

Detection condition:
filesize < 10KB and $x1 and 1 of ($s*)

Full rule:
rule APT_WEBSHELL_HAFNIUM_Chopper_WebShell: APT Hafnium WebShell {
   meta:
      description = "Detects Chopper WebShell Injection Variant (not only Hafnium related)"
      author = "Markus Neis,Swisscom"
      date = "2021-03-05"
      reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
      id = "25dcf166-4aea-5680-b161-c5fc8d74b987"
   strings:
      $x1 = "runat=\"server\">" nocase

      $s1 = "<script language=\"JScript\" runat=\"server\">function Page_Load(){eval(Request" nocase
      $s2 = "protected void Page_Load(object sender, EventArgs e){System.IO.StreamWriter sw = new System.IO.StreamWriter(Request.Form[\"p\"] , false, Encoding.Default);sw.Write(Request.Form[\"f\"]);"
      $s3 = "<script language=\"JScript\" runat=\"server\"> function Page_Load(){eval (Request[\"" nocase  
   condition:
      filesize < 10KB and $x1 and 1 of ($s*) 
}
YARA Detection Rule: APT_WEBSHELL_Tiny_WebShell
Repository: Neo23x0/signature-base
Detects: Detects WebShell Injection
Author: Markus Neis,Swisscom
Reference: https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/

Pattern signatures:
$x1 = "<%@ Page Language=\"Jscript\" Debug=true%>"

      $s1 = "=Request.Form(\""
      $s2 = "eval("

Detection condition:
filesize < 300 and all of ($s*) and $x1

Full rule:
rule APT_WEBSHELL_Tiny_WebShell : APT Hafnium WebShell {
   meta:
      description = "Detects WebShell Injection"
      author = "Markus Neis,Swisscom"
      hash = "099c8625c58b315b6c11f5baeb859f4c"
      date = "2021-03-05"
      reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
      id = "aa2fcecc-4c8b-570d-a81a-5dfb16c04e05"
   strings:
      $x1 = "<%@ Page Language=\"Jscript\" Debug=true%>"

      $s1 = "=Request.Form(\""
      $s2 = "eval("
   condition:
      filesize < 300 and all of ($s*) and $x1
}
YARA Detection Rule: HKTL_PS1_PowerCat_Mar21
Repository: Neo23x0/signature-base
Detects: Detects PowerCat hacktool
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/besimorhino/powercat

Pattern signatures:
$x1 = "powercat -l -p 8000 -r dns:10.1.1.1:53:c2.example.com" ascii fullword
      $x2 = "try{[byte[]]$ReturnedData = $Encoding.GetBytes((IEX $CommandToExecute 2>&1 | Out-String))}" ascii fullword

      $s1 = "Returning Encoded Payload..." ascii
      $s2 = "$CommandToExecute =" ascii fullword
      $s3 = "[alias(\"Execute\")][string]$e=\"\"," ascii

Detection condition:
uint16(0) == 0x7566 and
      filesize < 200KB and
      1 of ($x*) or 3 of them

Full rule:
rule HKTL_PS1_PowerCat_Mar21 {
   meta:
      description = "Detects PowerCat hacktool"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/besimorhino/powercat"
      date = "2021-03-02"
      hash1 = "c55672b5d2963969abe045fe75db52069d0300691d4f1f5923afeadf5353b9d2"
      id = "ae3963e8-2fe9-5bc3-bf72-95f136622832"
   strings:
      $x1 = "powercat -l -p 8000 -r dns:10.1.1.1:53:c2.example.com" ascii fullword
      $x2 = "try{[byte[]]$ReturnedData = $Encoding.GetBytes((IEX $CommandToExecute 2>&1 | Out-String))}" ascii fullword

      $s1 = "Returning Encoded Payload..." ascii
      $s2 = "$CommandToExecute =" ascii fullword
      $s3 = "[alias(\"Execute\")][string]$e=\"\"," ascii
   condition:
      uint16(0) == 0x7566 and
      filesize < 200KB and
      1 of ($x*) or 3 of them
}
YARA Detection Rule: HKTL_Nishang_PS1_Invoke_PowerShellTcpOneLine
Repository: Neo23x0/signature-base
Detects: Detects PowerShell Oneliner in Nishang's repository
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1

Pattern signatures:
$s1 = "=([text.encoding]::ASCII).GetBytes((iex $" ascii wide
      $s2 = ".GetStream();[byte[]]$" ascii wide
      $s3 = "New-Object Net.Sockets.TCPClient('" ascii wide

Detection condition:
all of them

Full rule:
rule HKTL_Nishang_PS1_Invoke_PowerShellTcpOneLine {
   meta:
      description = "Detects PowerShell Oneliner in Nishang's repository"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1"
      date = "2021-03-03"
      hash1 = "2f4c948974da341412ab742e14d8cdd33c1efa22b90135fcfae891f08494ac32"
      id = "0218ebbd-2dbe-5838-ab53-1e78e3f97b9e"
   strings:
      $s1 = "=([text.encoding]::ASCII).GetBytes((iex $" ascii wide
      $s2 = ".GetStream();[byte[]]$" ascii wide
      $s3 = "New-Object Net.Sockets.TCPClient('" ascii wide
   condition:
      all of them
}
YARA Detection Rule: WEBSHELL_ASPX_SimpleSeeSharp
Repository: Neo23x0/signature-base
Detects: A simple ASPX Webshell that allows an attacker to write further files to disk.
Author: threatintel@volexity.com
Reference: https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/

Pattern signatures:
$header = "<%@ Page Language=\"C#\" %>"
      $body = "<% HttpPostedFile thisFile = Request.Files[0];thisFile.SaveAs(Path.Combine"

Detection condition:
$header at 0 and
      $body and
      filesize < 1KB

Full rule:
rule WEBSHELL_ASPX_SimpleSeeSharp : Webshell Unclassified {
   meta:
      author = "threatintel@volexity.com"
      date = "2021-03-01"
      description = "A simple ASPX Webshell that allows an attacker to write further files to disk."
      hash = "893cd3583b49cb706b3e55ecb2ed0757b977a21f5c72e041392d1256f31166e2"
      reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
      id = "469fdf5c-e09e-5d44-a2e6-0864dcd0e18a"
   strings:
      $header = "<%@ Page Language=\"C#\" %>"
      $body = "<% HttpPostedFile thisFile = Request.Files[0];thisFile.SaveAs(Path.Combine"
   condition:
      $header at 0 and
      $body and
      filesize < 1KB
}
YARA Detection Rule: WEBSHELL_ASPX_reGeorgTunnel
Repository: Neo23x0/signature-base
Detects: variation on reGeorgtunnel
Author: threatintel@volexity.com
Reference: https://github.com/sensepost/reGeorg/blob/master/tunnel.aspx

Pattern signatures:
$s1 = "System.Net.Sockets"
      $s2 = "System.Text.Encoding.Default.GetString(Convert.FromBase64String(StrTr(Request.Headers.Get"
      $t1 = ".Split('|')"
      $t2 = "Request.Headers.Get"
      $t3 = ".Substring("
      $t4 = "new Socket("
      $t5 = "IPAddress ip;"

Detection condition:
all of ($s*) or
      all of ($t*)

Full rule:
rule WEBSHELL_ASPX_reGeorgTunnel : Webshell Commodity {
   meta:
      author = "threatintel@volexity.com"
      date = "2021-03-01"
      description = "variation on reGeorgtunnel"
      hash = "406b680edc9a1bb0e2c7c451c[PII_REDACTED]8b5f[PII_REDACTED]b73b232ff38928"
      reference = "https://github.com/sensepost/reGeorg/blob/master/tunnel.aspx"
      id = "b8aa27c9-a28a-5051-8f81-1184f28842ed"
   strings:
      $s1 = "System.Net.Sockets"
      $s2 = "System.Text.Encoding.Default.GetString(Convert.FromBase64String(StrTr(Request.Headers.Get"
      $t1 = ".Split('|')"
      $t2 = "Request.Headers.Get"
      $t3 = ".Substring("
      $t4 = "new Socket("
      $t5 = "IPAddress ip;"
   condition:
      all of ($s*) or
      all of ($t*)
}
YARA Detection Rule: WEBSHELL_ASPX_SportsBall
Repository: Neo23x0/signature-base
Detects: The SPORTSBALL webshell allows attackers to upload files or execute commands on the system.
Author: threatintel@volexity.com
Reference: https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/

Pattern signatures:
$uniq1 = "HttpCookie newcook = new HttpCookie(\"fqrspt\", HttpContext.Current.Request.Form"
      $uniq2 = "ZN2aDAB4rXsszEvCLrzgcvQ4oi5J1TuiRULlQbYwldE="

      $var1 = "Result.InnerText = string.Empty;"
      $var2 = "newcook.Expires = DateTime.Now.AddDays("
      $var3 = "System.Diagnostics.Process process = new System.Diagnostics.Process();"
      $var4 = "process.StandardInput.WriteLine(HttpContext.Current.Request.Form[\""
      $var5 = "else if (!string.IsNullOrEmpty(HttpContext.Current.Request.Form[\""
      $var6 = "<input type=\"submit\" value=\"Upload\" />"

Detection condition:
any of ($uniq*) or
      all of ($var*)

Full rule:
rule WEBSHELL_ASPX_SportsBall {
   meta:
      author = "threatintel@volexity.com"
      date = "2021-03-01"
      description = "The SPORTSBALL webshell allows attackers to upload files or execute commands on the system."
      hash = "2fa[PII_REDACTED]5110bba14a482020699a96f76fb1ceb80cbfa2df9d3008b5b0a"
      reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
      id = "25b23a4c-8fc7-5d6f-b4b5-46fe2c1546d8"
   strings:
      $uniq1 = "HttpCookie newcook = new HttpCookie(\"fqrspt\", HttpContext.Current.Request.Form"
      $uniq2 = "ZN2aDAB4rXsszEvCLrzgcvQ4oi5J1TuiRULlQbYwldE="

      $var1 = "Result.InnerText = string.Empty;"
      $var2 = "newcook.Expires = DateTime.Now.AddDays("
      $var3 = "System.Diagnostics.Process process = new System.Diagnostics.Process();"
      $var4 = "process.StandardInput.WriteLine(HttpContext.Current.Request.Form[\""
      $var5 = "else if (!string.IsNullOrEmpty(HttpContext.Current.Request.Form[\""
      $var6 = "<input type=\"submit\" value=\"Upload\" />"
   condition:
      any of ($uniq*) or
      all of ($var*)
}