deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: MAL_IcedID_GZIP_LDR_202104
Repository: Neo23x0/signature-base
Detects: 2021 initial Bokbot / Icedid loader for fake GZIP payloads
Author: Thomas Barabosch, Telekom Security
Reference: https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240

Pattern signatures:
$internal_name = "loader_dll_64.dll" fullword

      $string0 = "_gat=" wide
      $string1 = "_ga=" wide
      $string2 = "_gid=" wide
      $string4 = "_io=" wide
      $string5 = "GetAdaptersInfo" fullword
      $string6 = "WINHTTP.dll" fullword
      $string7 = "DllRegisterServer" fullword
      $string8 = "PluginInit" fullword
      $string9 = "POST" wide fullword
      $string10 = "aws.amazon.com" wide fullword

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 5000KB and 
      ( $internal_name or all of ($s*) )
      or all of them

Full rule:
rule MAL_IcedID_GZIP_LDR_202104 {
   meta:
      author = "Thomas Barabosch, Telekom Security"
      date = "2021-04-12"
      modified = "2023-01-27"
      description = "2021 initial Bokbot / Icedid loader for fake GZIP payloads"
      reference = "https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240"
      id = "fbf578e7-c318-5f67-82df-f93232362a23"
   strings:
      $internal_name = "loader_dll_64.dll" fullword

      $string0 = "_gat=" wide
      $string1 = "_ga=" wide
      $string2 = "_gid=" wide
      $string4 = "_io=" wide
      $string5 = "GetAdaptersInfo" fullword
      $string6 = "WINHTTP.dll" fullword
      $string7 = "DllRegisterServer" fullword
      $string8 = "PluginInit" fullword
      $string9 = "POST" wide fullword
      $string10 = "aws.amazon.com" wide fullword
   condition:
      uint16(0) == 0x5a4d and
      filesize < 5000KB and 
      ( $internal_name or all of ($s*) )
      or all of them
}
YARA Detection Rule: MAL_IcedId_Core_LDR_202104
Repository: Neo23x0/signature-base
Detects: 2021 loader for Bokbot / Icedid core (license.dat)
Author: Thomas Barabosch, Telekom Security
Reference: https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240

Pattern signatures:
$internal_name = "sadl_64.dll" fullword

      $string0 = "GetCommandLineA" fullword
      $string1 = "LoadLibraryA" fullword
      $string2 = "ProgramData" fullword
      $string3 = "SHLWAPI.dll" fullword
      $string4 = "SHGetFolderPathA" fullword
      $string5 = "DllRegisterServer" fullword
      $string6 = "update" fullword
      $string7 = "SHELL32.dll" fullword
      $string8 = "CreateThread" fullword

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 5000KB and 
      ( $internal_name and 5 of them )
      or all of them

Full rule:
rule MAL_IcedId_Core_LDR_202104 {
   meta:
      author = "Thomas Barabosch, Telekom Security"
      date = "2021-04-13"
      description = "2021 loader for Bokbot / Icedid core (license.dat)"
      reference = "https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240"
      id = "f096e18d-3a31-5236-b3c3-0df39b408d9a"
   strings:
      $internal_name = "sadl_64.dll" fullword

      $string0 = "GetCommandLineA" fullword
      $string1 = "LoadLibraryA" fullword
      $string2 = "ProgramData" fullword
      $string3 = "SHLWAPI.dll" fullword
      $string4 = "SHGetFolderPathA" fullword
      $string5 = "DllRegisterServer" fullword
      $string6 = "update" fullword
      $string7 = "SHELL32.dll" fullword
      $string8 = "CreateThread" fullword
   condition:
      uint16(0) == 0x5a4d and
      filesize < 5000KB and 
      ( $internal_name and 5 of them )
      or all of them
}
YARA Detection Rule: MAL_IceId_Core_202104
Repository: Neo23x0/signature-base
Detects: 2021 Bokbot / Icedid core
Author: Thomas Barabosch, Telekom Security
Reference: https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240

Pattern signatures:
$internal_name = "fixed_loader64.dll" fullword

      $string0 = "mail_vault" wide fullword
      $string1 = "ie_reg" wide fullword
      $string2 = "outlook" wide fullword
      $string3 = "user_num" wide fullword
      $string4 = "cred" wide fullword
      $string5 = "Authorization: Basic" fullword
      $string6 = "VaultOpenVault" fullword
      $string7 = "sqlite3_free" fullword
      $string8 = "cookie.tar" fullword
      $string9 = "DllRegisterServer" fullword
      $string10 = "PT0S" wide

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 5000KB and 
      ( $internal_name or all of ($s*) )
      or all of them

Full rule:
rule MAL_IceId_Core_202104 {
   meta:
      author = "Thomas Barabosch, Telekom Security"
      date = "2021-04-12"
      description = "2021 Bokbot / Icedid core"
      reference = "https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240"
      id = "526a73da-415f-58fe-bb5f-4c3df6b2e647"
   strings:
      $internal_name = "fixed_loader64.dll" fullword

      $string0 = "mail_vault" wide fullword
      $string1 = "ie_reg" wide fullword
      $string2 = "outlook" wide fullword
      $string3 = "user_num" wide fullword
      $string4 = "cred" wide fullword
      $string5 = "Authorization: Basic" fullword
      $string6 = "VaultOpenVault" fullword
      $string7 = "sqlite3_free" fullword
      $string8 = "cookie.tar" fullword
      $string9 = "DllRegisterServer" fullword
      $string10 = "PT0S" wide
   condition:
      uint16(0) == 0x5a4d and
      filesize < 5000KB and 
      ( $internal_name or all of ($s*) )
      or all of them
}
YARA Detection Rule: TidePool_Malware
Repository: Neo23x0/signature-base
Detects: Detects TidePool malware mentioned in Ke3chang report by Palo Alto Networks
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/m2CXWR

Pattern signatures:
$x1 = "Content-Disposition: form-data; name=\"m1.jpg\"" fullword ascii
		$x2 = "C:\\PROGRA~2\\IEHelper\\mshtml.dll" fullword wide
		$x3 = "C:\\DOCUME~1\\ALLUSE~1\\IEHelper\\mshtml.dll" fullword wide
		$x4 = "IEComDll.dat" fullword ascii

		$s1 = "Content-Type: multipart/form-data; boundary=----=_Part_%x" fullword wide
		$s2 = "C:\\Windows\\System32\\rundll32.exe" fullword wide
		$s3 = "network.proxy.socks_port\", " fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($x*) ) ) or ( 4 of them )

Full rule:
rule TidePool_Malware {
	meta:
		description = "Detects TidePool malware mentioned in Ke3chang report by Palo Alto Networks"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/m2CXWR"
		date = "2016-05-24"
		hash1 = "9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba"
		hash2 = "67c4e8ab0f12fae7b4aeb66f7e59e286bd98d3a77e5a291e8d58b3cfbc1514ed"
		hash3 = "2252dcd1b6afacde3f94d9557811bb769c4f0af3cb7a48ffe068d31bb7c30e18"
		hash4 = "38f2c86041e[PII_REDACTED]cdb9c530298c0c[PII_REDACTED]c4e7446544fd6dcac9f"
		hash5 = "9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba"
		id = "eec12fd7-f5f8-5bee-98e0-2111766deb55"
	strings:
		$x1 = "Content-Disposition: form-data; name=\"m1.jpg\"" fullword ascii
		$x2 = "C:\\PROGRA~2\\IEHelper\\mshtml.dll" fullword wide
		$x3 = "C:\\DOCUME~1\\ALLUSE~1\\IEHelper\\mshtml.dll" fullword wide
		$x4 = "IEComDll.dat" fullword ascii

		$s1 = "Content-Type: multipart/form-data; boundary=----=_Part_%x" fullword wide
		$s2 = "C:\\Windows\\System32\\rundll32.exe" fullword wide
		$s3 = "network.proxy.socks_port\", " fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($x*) ) ) or ( 4 of them )
}
YARA Detection Rule: apt_CN_Tetris_JS_advanced_1
Repository: Neo23x0/signature-base
Detects: Unique code from Jetriz, Swid & Jeniva of the Tetris framework
Author: @imp0rtp3 (modified by Florian Roth)
Reference: https://imp0rtp3.wordpress.com/2021/08/12/tetris

Pattern signatures:
$a1 = "var a0_0x"
      $b1 = "a0_0x" ascii
      
      $cx1 = "))),function(){try{var _0x"
      $cx2 = "=window)||void 0x0===_0x"
      $cx3 = "){if(opener&&void 0x0!==opener[" //not dep on a0
      $cx4 = "String['fromCharCode'](0x"
      
      $e1 = "')](__p__)"

Detection condition:
$a1 at 0 
   or (
      filesize < 1000KB
      and (
         #b1 > 300
         or #e1 > 1 
         or 2 of ($cx*)
      )
   )

Full rule:
rule apt_CN_Tetris_JS_advanced_1
{
    meta:
        author      = "@imp0rtp3 (modified by Florian Roth)"
        description = "Unique code from Jetriz, Swid & Jeniva of the Tetris framework"
        reference   = "https://imp0rtp3.wordpress.com/2021/08/12/tetris"
        date = "2020-09-06"

        id = "a56f69f5-3562-52ab-9686-411019c51055"
   strings:
      $a1 = "var a0_0x"
      $b1 = "a0_0x" ascii
      
      $cx1 = "))),function(){try{var _0x"
      $cx2 = "=window)||void 0x0===_0x"
      $cx3 = "){if(opener&&void 0x0!==opener[" //not dep on a0
      $cx4 = "String['fromCharCode'](0x"
      
      $e1 = "')](__p__)"
   condition:
   $a1 at 0 
   or (
      filesize < 1000KB
      and (
         #b1 > 300
         or #e1 > 1 
         or 2 of ($cx*)
      )
   )
}
YARA Detection Rule: EXPL_LNX_CUPS_CVE_2024_47177_Sep24
Repository: Neo23x0/signature-base
Detects: Detects exploit code for CUPS CVE-2024-47177
Author: Florian Roth
Reference: https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8

Pattern signatures:
$s1 = "FoomaticRIPCommandLine: " ascii
      $s2 = "cupsFilter2 : " ascii

Detection condition:
filesize < 400KB and all of them

Full rule:
rule EXPL_LNX_CUPS_CVE_2024_47177_Sep24 {
   meta:
      description = "Detects exploit code for CUPS CVE-2024-47177"
      author = "Florian Roth"
      reference = "https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8"
      date = "2024-09-27"
      score = 75
      id = "a7b986ad-e943-5350-a6e0-34c40f07874c"
   strings:
      $s1 = "FoomaticRIPCommandLine: " ascii
      $s2 = "cupsFilter2 : " ascii
   condition:
      filesize < 400KB and all of them
}
YARA Detection Rule: SUSP_EXPL_LNX_CUPS_CVE_2024_47177_Sep24
Repository: Neo23x0/signature-base
Detects: Detects suspicious FoomaticRIPCommandLine command in printer config, which could be used to exploit CUPS CVE-2024-47177
Author: Florian Roth
Reference: https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8

Pattern signatures:
$ = "FoomaticRIPCommandLine: \"bash " ascii
      $ = "FoomaticRIPCommandLine: \"sh " ascii
      $ = "FoomaticRIPCommandLine: \"python " ascii
      $ = "FoomaticRIPCommandLine: \"perl " ascii
      $ = "FoomaticRIPCommandLine: \"echo " ascii
      $ = "FoomaticRIPCommandLine: \\\"bash " ascii
      $ = "FoomaticRIPCommandLine: \\\"sh " ascii
      $ = "FoomaticRIPCommandLine: \\\"python " ascii
      $ = "FoomaticRIPCommandLine: \\\"perl " ascii
      $ = "FoomaticRIPCommandLine: \\\"echo " ascii

Detection condition:
1 of them

Full rule:
rule SUSP_EXPL_LNX_CUPS_CVE_2024_47177_Sep24 {
   meta:
      description = "Detects suspicious FoomaticRIPCommandLine command in printer config, which could be used to exploit CUPS CVE-2024-47177"
      author = "Florian Roth"
      reference = "https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8"
      date = "2024-09-27"
      score = 65
      id = "cb76f1c7-6dc0-5fed-a970-2a4890db46d3"
   strings:
      $ = "FoomaticRIPCommandLine: \"bash " ascii
      $ = "FoomaticRIPCommandLine: \"sh " ascii
      $ = "FoomaticRIPCommandLine: \"python " ascii
      $ = "FoomaticRIPCommandLine: \"perl " ascii
      $ = "FoomaticRIPCommandLine: \"echo " ascii
      $ = "FoomaticRIPCommandLine: \\\"bash " ascii
      $ = "FoomaticRIPCommandLine: \\\"sh " ascii
      $ = "FoomaticRIPCommandLine: \\\"python " ascii
      $ = "FoomaticRIPCommandLine: \\\"perl " ascii
      $ = "FoomaticRIPCommandLine: \\\"echo " ascii
   condition:
      1 of them
}
YARA Detection Rule: PP_CN_APT_ZeroT_1
Repository: Neo23x0/signature-base
Detects: Detects malware from the Proofpoint CN APT ZeroT incident
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx

Pattern signatures:
$s1 = "suprise.exe" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )

Full rule:
rule PP_CN_APT_ZeroT_1 {
   meta:
      description = "Detects malware from the Proofpoint CN APT ZeroT incident"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
      date = "2017-02-03"
      hash1 = "09061c603a32ac99b664f7434febfc8c1f9fd7b6469be289bb130a635a6c47c0"
      id = "c16f3abb-ac7e-5d5f-b8d7-b105cff3886e"
   strings:
      $s1 = "suprise.exe" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
}
YARA Detection Rule: PP_CN_APT_ZeroT_2
Repository: Neo23x0/signature-base
Detects: Detects malware from the Proofpoint CN APT ZeroT incident
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx

Pattern signatures:
$s1 = "NO2[PII_REDACTED].exe" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )

Full rule:
rule PP_CN_APT_ZeroT_2 {
   meta:
      description = "Detects malware from the Proofpoint CN APT ZeroT incident"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
      date = "2017-02-03"
      hash1 = "74eb592ef7f5967b14794acdc916686e061a43169f06e5be4dca70811b9815df"
      id = "8433216e-1189-568c-bd18-051fb1fec215"
   strings:
      $s1 = "NO2[PII_REDACTED].exe" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
}
YARA Detection Rule: PP_CN_APT_ZeroT_3
Repository: Neo23x0/signature-base
Detects: Detects malware from the Proofpoint CN APT ZeroT incident
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx

Pattern signatures:
$s1 = "/svchost.exe" fullword ascii
      $s2 = "RasTls.dll" fullword ascii
      $s3 = "20160620.htm" fullword ascii
      $s4 = "* $l&$" fullword ascii
      $s5 = "dfjhmh" fullword ascii
      $s6 = "/20160620.htm" fullword ascii

Detection condition:
( uint16(0) == 0x5449 and filesize < 1000KB and 3 of them ) or ( all of them )

Full rule:
rule PP_CN_APT_ZeroT_3 {
   meta:
      description = "Detects malware from the Proofpoint CN APT ZeroT incident"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
      date = "2017-02-03"
      hash1 = "ee2e2937128dac91a11e9bf55babc1a8387eb16cebe676142c885b2fc18669b2"
      id = "99aa29cf-d962-5a3d-bd28-6486c40822bb"
   strings:
      $s1 = "/svchost.exe" fullword ascii
      $s2 = "RasTls.dll" fullword ascii
      $s3 = "20160620.htm" fullword ascii
      $s4 = "* $l&$" fullword ascii
      $s5 = "dfjhmh" fullword ascii
      $s6 = "/20160620.htm" fullword ascii
   condition:
      ( uint16(0) == 0x5449 and filesize < 1000KB and 3 of them ) or ( all of them )
}
YARA Detection Rule: PP_CN_APT_ZeroT_4
Repository: Neo23x0/signature-base
Detects: Detects malware from the Proofpoint CN APT ZeroT incident
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx

Pattern signatures:
$s1 = "Mcutil.dll" fullword ascii
      $s2 = "mcut.exe" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )

Full rule:
rule PP_CN_APT_ZeroT_4 {
   meta:
      description = "Detects malware from the Proofpoint CN APT ZeroT incident"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
      date = "2017-02-03"
      hash1 = "a9519d2624a842d2c9060b64bb78ee1c400fea9e43d4436371a67cbf90e611b8"
      id = "b21961ee-d346-51d3-bacd[PII_REDACTED]2d"
   strings:
      $s1 = "Mcutil.dll" fullword ascii
      $s2 = "mcut.exe" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )
}
YARA Detection Rule: PP_CN_APT_ZeroT_5
Repository: Neo23x0/signature-base
Detects: Detects malware from the Proofpoint CN APT ZeroT incident
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx

Pattern signatures:
$x1 = "dbozcb" fullword ascii

      $s1 = "nflogger.dll" fullword ascii
      $s2 = "/svchost.exe" fullword ascii
      $s3 = "1207.htm" fullword ascii
      $s4 = "/1207.htm" fullword ascii

Detection condition:
( uint16(0) == 0x5449 and filesize < 1000KB and 1 of ($x*) and 1 of ($s*) ) or ( all of them )

Full rule:
rule PP_CN_APT_ZeroT_5 {
   meta:
      description = "Detects malware from the Proofpoint CN APT ZeroT incident"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
      date = "2017-02-03"
      hash1 = "74dd52aeac83cc01c348528a9bcb20bbc34622b156f40654153e41817083ba1d"
      id = "2a7c6a36-aace-562e-bbc4-425c1d93fab1"
   strings:
      $x1 = "dbozcb" fullword ascii

      $s1 = "nflogger.dll" fullword ascii
      $s2 = "/svchost.exe" fullword ascii
      $s3 = "1207.htm" fullword ascii
      $s4 = "/1207.htm" fullword ascii
   condition:
      ( uint16(0) == 0x5449 and filesize < 1000KB and 1 of ($x*) and 1 of ($s*) ) or ( all of them )
}
YARA Detection Rule: PP_CN_APT_ZeroT_6
Repository: Neo23x0/signature-base
Detects: Detects malware from the Proofpoint CN APT ZeroT incident
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx

Pattern signatures:
$s1 = "jGetgQ|0h9=" fullword ascii
      $s2 = "\\sfxrar32\\Release\\sfxrar.pdb"

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and all of them

Full rule:
rule PP_CN_APT_ZeroT_6 {
   meta:
      description = "Detects malware from the Proofpoint CN APT ZeroT incident"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
      date = "2017-02-03"
      hash1 = "a16078c6d09fcfc9d6ff7a91e39e6d72e2d6d6ab6080930e1e2169ec002b37d3"
      id = "2e3bb4bd-5e20-56e7-a82b-d717d83eaeeb"
   strings:
      $s1 = "jGetgQ|0h9=" fullword ascii
      $s2 = "\\sfxrar32\\Release\\sfxrar.pdb"
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and all of them
}
YARA Detection Rule: PP_CN_APT_ZeroT_7
Repository: Neo23x0/signature-base
Detects: Detects malware from the Proofpoint CN APT ZeroT incident
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx

Pattern signatures:
$s1 = "RasTls.dll" fullword ascii
      $s2 = "RasTls.exe" fullword ascii
      $s4 = "LOADER ERROR" fullword ascii
      $s5 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )

Full rule:
rule PP_CN_APT_ZeroT_7 {
   meta:
      description = "Detects malware from the Proofpoint CN APT ZeroT incident"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
      date = "2017-02-03"
      hash1 = "fc2d47d91ad8517a4a974c4570b346b41646fac333d219d2f1282c96b4571478"
      id = "e9cdca86-84a8-5673-935c-c319b523674b"
   strings:
      $s1 = "RasTls.dll" fullword ascii
      $s2 = "RasTls.exe" fullword ascii
      $s4 = "LOADER ERROR" fullword ascii
      $s5 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )
}
YARA Detection Rule: PP_CN_APT_ZeroT_8
Repository: Neo23x0/signature-base
Detects: Detects malware from the Proofpoint CN APT ZeroT incident
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx

Pattern signatures:
$s1 = "/svchost.exe" fullword ascii
      $s2 = "RasTls.dll" fullword ascii
      $s3 = "20160620.htm" fullword ascii
      $s4 = "/20160620.htm" fullword ascii

Detection condition:
( uint16(0) == 0x5449 and filesize < 1000KB and 3 of them )

Full rule:
rule PP_CN_APT_ZeroT_8 {
   meta:
      description = "Detects malware from the Proofpoint CN APT ZeroT incident"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
      date = "2017-02-03"
      hash1 = "4ef91c17b1415609a2394d2c6c353318a2503900e400aab25ab96c9fe7dc92ff"
      id = "f9a4f092-c699-5e91-9667-64ffe1b02bc1"
   strings:
      $s1 = "/svchost.exe" fullword ascii
      $s2 = "RasTls.dll" fullword ascii
      $s3 = "20160620.htm" fullword ascii
      $s4 = "/20160620.htm" fullword ascii
   condition:
      ( uint16(0) == 0x5449 and filesize < 1000KB and 3 of them )
}
YARA Detection Rule: PP_CN_APT_ZeroT_9
Repository: Neo23x0/signature-base
Detects: Detects malware from the Proofpoint CN APT ZeroT incident
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx

Pattern signatures:
$x1 = "nflogger.dll" fullword ascii
      $s7 = "Zlh.exe" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )

Full rule:
rule PP_CN_APT_ZeroT_9 {
   meta:
      description = "Detects malware from the Proofpoint CN APT ZeroT incident"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
      date = "2017-02-03"
      hash1 = "a685cf4dca6a58213e67d041bba637dca9cb3ea6bb9ad3eae3ba85229118bce0"
      id = "e1c32993-409c-5a62-8239-cff99fb83a7f"
   strings:
      $x1 = "nflogger.dll" fullword ascii
      $s7 = "Zlh.exe" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )
}