deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: HKTL_EDR_Freeze_Sep25_2
Repository: Neo23x0/signature-base
Detects: Detects EDR-Freeze hacktool
Author: Florian Roth
Reference: https://github.com/TwoSevenOneT/EDR-Freeze

Pattern signatures:
$x1 = "EDR-Freeze.exe <TargetPID> <SleepTime>" wide fullword
      $x2 = "Successfully created PPL process with PID:" wide fullword
      $x3 = "\\EDR-Freeze.pdb" ascii

      $sa1 = "C:\\Windows\\System32\\WerFaultSecure.exe" wide fullword  /* String occurs 2 times in goodware */
      $sa2 = "Failed to create dump files: " wide fullword

      $sb1 = " /encfile" wide fullword
      $sb2 = " /pid" wide fullword
      $sb3 = " /tid" wide fullword
      $sb4 = " /cancel" wide fullword

Detection condition:
uint16(0) == 0x5a4d
      and filesize < 1000KB
      and (
         1 of ($x*)
         or all of ($sa*)
         or all of ($sb*)
      ) or 6 of them

Full rule:
rule HKTL_EDR_Freeze_Sep25_2 {
   meta:
      description = "Detects EDR-Freeze hacktool"
      author = "Florian Roth"
      reference = "https://github.com/TwoSevenOneT/EDR-Freeze"
      date = "2025-09-30"
      score = 80
      hash1 = "193ca17f574fa5e[PII_REDACTED]0425f83696f78e83dabd7e831dd7827a69283fd"
      hash2 = "36a17919a97732f1ddc31b421c6ebb0c535924f895d7caaff04a5da908c42f76"
      hash3 = "394b768bfd3506a9ee6b7bbe6f87c40fb23c28f7919a2a9eb333b27db635eafe"
      hash4 = "a8ec07f006a9068ce5f068b3bb61b0649481b6b26203b8eb4308c53ff1d1bf8d"
      hash5 = "d485017fb20c5a8fe38a6dbf896d4cbce485ff53a6cfe0e1440a1818b2d303ee"
      hash6 = "d989ebd417e6fae60a544e43bfc0ee63f5d9352ce0059b95ed4e7e18efbc5d0b"
      hash7 = "e2b2dd0984e[PII_REDACTED]2471f6a09020eb8380aa53d48d2fb4dd3aaa7edae9b"
   strings:
      $x1 = "EDR-Freeze.exe <TargetPID> <SleepTime>" wide fullword
      $x2 = "Successfully created PPL process with PID:" wide fullword
      $x3 = "\\EDR-Freeze.pdb" ascii

      $sa1 = "C:\\Windows\\System32\\WerFaultSecure.exe" wide fullword  /* String occurs 2 times in goodware */
      $sa2 = "Failed to create dump files: " wide fullword

      $sb1 = " /encfile" wide fullword
      $sb2 = " /pid" wide fullword
      $sb3 = " /tid" wide fullword
      $sb4 = " /cancel" wide fullword
   condition:
      uint16(0) == 0x5a4d
      and filesize < 1000KB
      and (
         1 of ($x*)
         or all of ($sa*)
         or all of ($sb*)
      ) or 6 of them
}
YARA Detection Rule: Win32_Buzus_Softpulse
Repository: Neo23x0/signature-base
Detects: Trojan Buzus / Softpulse
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$x1 = "pi4izd6vp0.com" fullword ascii

		$s1 = "SELECT * FROM Win32_Process" fullword wide
		$s4 = "CurrentVersion\\Uninstall\\avast" fullword wide
		$s5 = "Find_RepeatProcess" fullword ascii
		$s6 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\" wide
		$s7 = "myapp.exe" fullword ascii
		$s14 = "/c ping -n 1 www.google" wide

Detection condition:
uint16(0) == 0x5a4d and 
			( 
				( $x1 and 2 of ($s*) ) or
				all of ($s*) 
			)

Full rule:
rule Win32_Buzus_Softpulse {
	meta:
		description = "Trojan Buzus / Softpulse"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015-05-13"
		hash = "2f6df200e63a[PII_REDACTED]9a74180466d2e99ea9"
		score = 75
		id = "3b555916-030a-5773-b2f1-e995fc81b697"
	strings:
		$x1 = "pi4izd6vp0.com" fullword ascii

		$s1 = "SELECT * FROM Win32_Process" fullword wide
		$s4 = "CurrentVersion\\Uninstall\\avast" fullword wide
		$s5 = "Find_RepeatProcess" fullword ascii
		$s6 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\" wide
		$s7 = "myapp.exe" fullword ascii
		$s14 = "/c ping -n 1 www.google" wide
	condition:
		uint16(0) == 0x5a4d and 
			( 
				( $x1 and 2 of ($s*) ) or
				all of ($s*) 
			)
}
YARA Detection Rule: PS_AMSI_Bypass
Repository: Neo23x0/signature-base
Detects: Detects PowerShell AMSI Bypass
Author: Florian Roth (Nextron Systems)
Reference: https://gist.github.com/mattifestation/46d6a2ebb4a1f4f0e7229503dc012ef1

Pattern signatures:
$s1 = ".GetField('amsiContext',[Reflection.BindingFlags]'NonPublic,Static')." ascii nocase

Detection condition:
1 of them

Full rule:
rule PS_AMSI_Bypass : FILE {
   meta:
      description = "Detects PowerShell AMSI Bypass"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://gist.github.com/mattifestation/46d6a2ebb4a1f4f0e7229503dc012ef1"
      date = "2017-07-19"
      score = 65
      id = "31ab8932-4c74-5251-a044-3fcc0aa159f4"
   strings:
      $s1 = ".GetField('amsiContext',[Reflection.BindingFlags]'NonPublic,Static')." ascii nocase
   condition:
      1 of them
}
YARA Detection Rule: JS_Suspicious_Obfuscation_Dropbox
Repository: Neo23x0/signature-base
Detects: Detects PowerShell AMSI Bypass
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/ItsReallyNick/status/[PII_REDACTED]39343104

Pattern signatures:
$x1 = "j\"+\"a\"+\"v\"+\"a\"+\"s\"+\"c\"+\"r\"+\"i\"+\"p\"+\"t\""
      $x2 = "script:https://www.dropbox.com" ascii

Detection condition:
2 of them

Full rule:
rule JS_Suspicious_Obfuscation_Dropbox {
   meta:
      description = "Detects PowerShell AMSI Bypass"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/ItsReallyNick/status/[PII_REDACTED]39343104"
      date = "2017-07-19"
      score = 70
      id = "9b6b288d-3a15-5267-bbb1-885febf4df78"
   strings:
      $x1 = "j\"+\"a\"+\"v\"+\"a\"+\"s\"+\"c\"+\"r\"+\"i\"+\"p\"+\"t\""
      $x2 = "script:https://www.dropbox.com" ascii
   condition:
      2 of them
}
YARA Detection Rule: JS_Suspicious_MSHTA_Bypass
Repository: Neo23x0/signature-base
Detects: Detects MSHTA Bypass
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/ItsReallyNick/status/[PII_REDACTED]39343104

Pattern signatures:
$s1 = "mshtml,RunHTMLApplication" ascii
      $s2 = "new ActiveXObject(\"WScript.Shell\").Run(" ascii
      $s3 = "/c start mshta j" ascii nocase

Detection condition:
2 of them

Full rule:
rule JS_Suspicious_MSHTA_Bypass {
   meta:
      description = "Detects MSHTA Bypass"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/ItsReallyNick/status/[PII_REDACTED]39343104"
      date = "2017-07-19"
      score = 70
      id = "b2ddca78-c19a-5bb6-a1c9-4413e637ab1d"
   strings:
      $s1 = "mshtml,RunHTMLApplication" ascii
      $s2 = "new ActiveXObject(\"WScript.Shell\").Run(" ascii
      $s3 = "/c start mshta j" ascii nocase
   condition:
      2 of them
}
YARA Detection Rule: JavaScript_Run_Suspicious
Repository: Neo23x0/signature-base
Detects: Detects a suspicious Javascript Run command
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/craiu/status/[PII_REDACTED]60998912

Pattern signatures:
$s1 = "w = new ActiveXObject(" ascii
      $s2 = " w.Run(r);" fullword ascii

Detection condition:
all of them

Full rule:
rule JavaScript_Run_Suspicious {
   meta:
      description = "Detects a suspicious Javascript Run command"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/craiu/status/[PII_REDACTED]60998912"
      score = 60
      date = "2017-08-23"
      id = "87f98ead-3052-5777-8[PII_REDACTED]73aaa"
   strings:
      $s1 = "w = new ActiveXObject(" ascii
      $s2 = " w.Run(r);" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: Certutil_Decode_OR_Download
Repository: Neo23x0/signature-base
Detects: Certutil Decode
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$a1 = "certutil -decode " ascii wide
      $a2 = "certutil  -decode " ascii wide
      $a3 = "certutil.exe -decode " ascii wide
      $a4 = "certutil.exe  -decode " ascii wide
      $a5 = "certutil -urlcache -split -f http" ascii wide
      $a6 = "certutil.exe -urlcache -split -f http" ascii wide

      $fp_msi = { 52 00 6F 00 6F 00 74 00 20 00 45 00 6E 00 74 00 72 00 79 }
      $fp_doc = "https://docs.aws.amazon.com" ascii

Detection condition:
filesize < 700KB
      and 1 of ($a*)
      and not 1 of ($fp*)

Full rule:
rule Certutil_Decode_OR_Download {
   meta:
      description = "Certutil Decode"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      score = 40
      date = "2017-08-29"
      modified = "2026-04-01"
      id = "63bdefd2-225a-56d5-b615-5e236c97f050"
   strings:
      $a1 = "certutil -decode " ascii wide
      $a2 = "certutil  -decode " ascii wide
      $a3 = "certutil.exe -decode " ascii wide
      $a4 = "certutil.exe  -decode " ascii wide
      $a5 = "certutil -urlcache -split -f http" ascii wide
      $a6 = "certutil.exe -urlcache -split -f http" ascii wide

      $fp_msi = { 52 00 6F 00 6F 00 74 00 20 00 45 00 6E 00 74 00 72 00 79 }
      $fp_doc = "https://docs.aws.amazon.com" ascii
   condition:
      filesize < 700KB
      and 1 of ($a*)
      and not 1 of ($fp*)
}
YARA Detection Rule: Suspicious_JS_script_content
Repository: Neo23x0/signature-base
Detects: Detects suspicious statements in JavaScript files
Author: Florian Roth (Nextron Systems)
Reference: Research on Leviathan https://goo.gl/MZ7dRg

Pattern signatures:
$x1 = "new ActiveXObject('WScript.Shell')).Run('cmd /c " ascii
      $x2 = ".Run('regsvr32 /s /u /i:" ascii
      $x3 = "new ActiveXObject('WScript.Shell')).Run('regsvr32 /s" fullword ascii
      $x4 = "args='/s /u /i:" ascii

Detection condition:
( filesize < 10KB and 1 of them )

Full rule:
rule Suspicious_JS_script_content {
   meta:
      description = "Detects suspicious statements in JavaScript files"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Research on Leviathan https://goo.gl/MZ7dRg"
      date = "2017-12-02"
      score = 70
      hash1 = "fc0fad39b461eb1cfc6be57932993fcea94fca650564271d1b74dd850c81602f"
      id = "6a547aa5-c58c-5559-9d3f-3f0d541eafd4"
   strings:
      $x1 = "new ActiveXObject('WScript.Shell')).Run('cmd /c " ascii
      $x2 = ".Run('regsvr32 /s /u /i:" ascii
      $x3 = "new ActiveXObject('WScript.Shell')).Run('regsvr32 /s" fullword ascii
      $x4 = "args='/s /u /i:" ascii
   condition:
      ( filesize < 10KB and 1 of them )
}
YARA Detection Rule: Universal_Exploit_Strings
Repository: Neo23x0/signature-base
Detects: Detects a group of strings often used in exploit codes
Author: Florian Roth (Nextron Systems)
Reference: not set

Pattern signatures:
$s1 = "Exploit" fullword ascii
      $s2 = "Payload" fullword ascii
      $s3 = "CVE-201" ascii
      $s4 = "bindshell"

Detection condition:
( filesize < 2KB and 3 of them )

Full rule:
rule Universal_Exploit_Strings {
   meta:
      description = "Detects a group of strings often used in exploit codes"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "not set"
      date = "2017-12-02"
      score = 50
      hash1 = "9b07dacf8a45218ede6d64327c38478640ff17d0f1e525bd392c002e49fe3629"
      id = "4b3a9eec-5f7c-579c-9719-fe23cc291aee"
   strings:
      $s1 = "Exploit" fullword ascii
      $s2 = "Payload" fullword ascii
      $s3 = "CVE-201" ascii
      $s4 = "bindshell"
   condition:
      ( filesize < 2KB and 3 of them )
}
YARA Detection Rule: VBS_Obfuscated_Mal_Feb18_1
Repository: Neo23x0/signature-base
Detects: Detects malicious obfuscated VBS observed in February 2018
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/zPsn83

Pattern signatures:
$x1 = "A( Array( (1* 2^1 )+" ascii
      $x2 = ".addcode(A( Array(" ascii
      $x3 = "false:AA.send:Execute(AA.responsetext):end" ascii
      $x4 = "& A( Array(  (1* 2^1 )+" ascii

      $s1 = ".SYSTEMTYPE:NEXT:IF (UCASE(" ascii
      $s2 = "A = STR:next:end function" ascii
      $s3 = "&WSCRIPT.SCRIPTFULLNAME&CHR" fullword ascii

Detection condition:
filesize < 600KB and ( 1 of ($x*) or 3 of them )

Full rule:
rule VBS_Obfuscated_Mal_Feb18_1  {
   meta:
      description = "Detects malicious obfuscated VBS observed in February 2018"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/zPsn83"
      date = "2018-02-12"
      hash1 = "06960cb721609fe5a857fe9ca3696a84baba88d06c20920370ddba1b0952a8ab"
      hash2 = "c5c0e28093e133d03c3806da0061a35776eed47d351e817709d2235b95d3a036"
      hash3 = "e1765a2b10e2ff10235762b9c65e9f5a4b3b47d292933f1a710e241fe0417a74"
      id = "39ea10e5-9dea-5cc8-8388-15378fcbab60"
   strings:
      $x1 = "A( Array( (1* 2^1 )+" ascii
      $x2 = ".addcode(A( Array(" ascii
      $x3 = "false:AA.send:Execute(AA.responsetext):end" ascii
      $x4 = "& A( Array(  (1* 2^1 )+" ascii

      $s1 = ".SYSTEMTYPE:NEXT:IF (UCASE(" ascii
      $s2 = "A = STR:next:end function" ascii
      $s3 = "&WSCRIPT.SCRIPTFULLNAME&CHR" fullword ascii
   condition:
      filesize < 600KB and ( 1 of ($x*) or 3 of them )
}
YARA Detection Rule: Armitage_msfconsole
Repository: Neo23x0/signature-base
Detects: Detects Armitage component
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "\\umeterpreter\\u >" ascii
      $s3 = "^meterpreter >" fullword ascii
      $s11 = "\\umsf\\u>" ascii

Detection condition:
filesize < 1KB and 2 of them

Full rule:
rule Armitage_msfconsole {
   meta:
      description = "Detects Armitage component"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-12-24"
      modified = "2022-08-18"
      hash1 = "662ba75c7ed5ac55a898f480ed2555d47d127a2d96424324b02724b3b2c95b6a"
      id = "9c610cd0-663e-54ea-a0f2-6c044fc45d23"
   strings:
      $s1 = "\\umeterpreter\\u >" ascii
      $s3 = "^meterpreter >" fullword ascii
      $s11 = "\\umsf\\u>" ascii
   condition:
      filesize < 1KB and 2 of them
}
YARA Detection Rule: Armitage_MeterpreterSession_Strings
Repository: Neo23x0/signature-base
Detects: Detects Armitage component
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "session.meterpreter_read" fullword ascii
      $s2 = "sniffer_dump" fullword ascii
      $s3 = "keyscan_dump" fullword ascii
      $s4 = "MeterpreterSession.java" fullword ascii

Detection condition:
filesize < 30KB and 1 of them

Full rule:
rule Armitage_MeterpreterSession_Strings {
   meta:
      description = "Detects Armitage component"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-12-24"
      hash1 = "b258b2f12f57ed05d8eafd29e9ecc126ae301ead9944a616b87c240bf1e71f9a"
      hash2 = "144cb6b1cf52e60f16b45ddf1633132c75de393c2705773b9f67fce334a3c8b8"
      id = "c49fdb73-1c95-5c63-b039-2fddb77290dc"
   strings:
      $s1 = "session.meterpreter_read" fullword ascii
      $s2 = "sniffer_dump" fullword ascii
      $s3 = "keyscan_dump" fullword ascii
      $s4 = "MeterpreterSession.java" fullword ascii
   condition:
      filesize < 30KB and 1 of them
}
YARA Detection Rule: Armitage_OSX
Repository: Neo23x0/signature-base
Detects: Detects Armitage component
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "resources/covertvpn-injector.exe" fullword ascii
      $s10 = "resources/browserpivot.x64.dll" fullword ascii
      $s17 = "resources/msfrpcd_new.bat" fullword ascii

Detection condition:
filesize < 6000KB and 1 of them

Full rule:
rule Armitage_OSX {
   meta:
      description = "Detects Armitage component"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-12-24"
      hash1 = "2680d9900a057d553fcb28d84cdc41c3fc18fd224a88a32ee14c9c1b501a86af"
      hash2 = "b7b506f38d0553cd2beb4111c7ef383c821f04cee5169fed2ef5d869c9fbfab3"
      id = "e886e866-c163-56fb-9631-c586e9f23f9e"
   strings:
      $x1 = "resources/covertvpn-injector.exe" fullword ascii
      $s10 = "resources/browserpivot.x64.dll" fullword ascii
      $s17 = "resources/msfrpcd_new.bat" fullword ascii
   condition:
      filesize < 6000KB and 1 of them
}
YARA Detection Rule: Mal_Dropper_httpEXE_from_CAB
Repository: Neo23x0/signature-base
Detects: Detects a dropper from a CAB file mentioned in the article
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/13Wgy1

Pattern signatures:
$s1 = "029.Hdl" fullword ascii
		$s2 = "http.exe" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and ( all of ($s*) ) )

Full rule:
rule Mal_Dropper_httpEXE_from_CAB {
	meta:
		description = "Detects a dropper from a CAB file mentioned in the article"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/13Wgy1"
		date = "2016-05-25"
		score = 60
		hash1 = "9e7e5f70c4b32a4d5e8c798c26671843e76bb4bd5967056a822e982ed36e047b"
		id = "f67c13e9-67e7-56aa-8ced-55e9bb814971"
	strings:
		$s1 = "029.Hdl" fullword ascii
		$s2 = "http.exe" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 1000KB and ( all of ($s*) ) )
}
YARA Detection Rule: Mal_http_EXE
Repository: Neo23x0/signature-base
Detects: Detects trojan from APT report named http.exe
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/13Wgy1

Pattern signatures:
$x1 = "Content-Disposition: form-data; name=\"file1\"; filename=\"%s\"" fullword ascii
		$x2 = "%ALLUSERSPROFILE%\\Accessories\\wordpade.exe" fullword ascii
		$x3 = "\\dumps.dat" ascii
		$x4 = "\\wordpade.exe" ascii
		$x5 = "\\%s|%s|4|%d|%4d-%02d-%02d %02d:%02d:%02d|" ascii
		$x6 = "\\%s|%s|5|%d|%4d-%02d-%02d %02d:%02d:%02d|" ascii
		$x7 = "cKaNBh9fnmXgJcSBxx5nFS+8s7abcQ==" fullword ascii
		$x8 = "cKaNBhFLn1nXMcCR0RlbMQ==" fullword ascii /* base64: pKY1[1 */

		$s1 = "SELECT * FROM moz_logins;" fullword ascii
		$s2 = "makescr.dat" fullword ascii
		$s3 = "%s\\Mozilla\\Firefox\\profiles.ini" fullword ascii
		$s4 = "?moz-proxy://" ascii
		$s5 = "[%s-%s] Title: %s" fullword ascii
		$s6 = "Cforeign key mismatch - \"%w\" referencing \"%w\"" fullword ascii
		$s7 = "Windows 95 SR2" fullword ascii
		$s8 = "\\|%s|0|0|" ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) and 2 of ($s*) ) ) or ( 3 of ($x*) )

Full rule:
rule Mal_http_EXE {
	meta:
		description = "Detects trojan from APT report named http.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/13Wgy1"
		date = "2016-05-25"
		modified = "2023-01-27"
		score = 80
		hash1 = "ad191d1d18841f0c5e48a5a1c9072709e2dd6359a6f6d427e0de59cfcd1d9666"
		id = "bcae9920-56ea-54a1-857b-70c275090e19"
	strings:
		$x1 = "Content-Disposition: form-data; name=\"file1\"; filename=\"%s\"" fullword ascii
		$x2 = "%ALLUSERSPROFILE%\\Accessories\\wordpade.exe" fullword ascii
		$x3 = "\\dumps.dat" ascii
		$x4 = "\\wordpade.exe" ascii
		$x5 = "\\%s|%s|4|%d|%4d-%02d-%02d %02d:%02d:%02d|" ascii
		$x6 = "\\%s|%s|5|%d|%4d-%02d-%02d %02d:%02d:%02d|" ascii
		$x7 = "cKaNBh9fnmXgJcSBxx5nFS+8s7abcQ==" fullword ascii
		$x8 = "cKaNBhFLn1nXMcCR0RlbMQ==" fullword ascii /* base64: pKY1[1 */

		$s1 = "SELECT * FROM moz_logins;" fullword ascii
		$s2 = "makescr.dat" fullword ascii
		$s3 = "%s\\Mozilla\\Firefox\\profiles.ini" fullword ascii
		$s4 = "?moz-proxy://" ascii
		$s5 = "[%s-%s] Title: %s" fullword ascii
		$s6 = "Cforeign key mismatch - \"%w\" referencing \"%w\"" fullword ascii
		$s7 = "Windows 95 SR2" fullword ascii
		$s8 = "\\|%s|0|0|" ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) and 2 of ($s*) ) ) or ( 3 of ($x*) )
}
YARA Detection Rule: Mal_PotPlayer_DLL
Repository: Neo23x0/signature-base
Detects: Detects a malicious PotPlayer.dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/13Wgy1

Pattern signatures:
$x1 = "C:\\Users\\john\\Desktop\\PotPlayer\\Release\\PotPlayer.pdb" fullword ascii

		$s3 = "PotPlayer.dll" fullword ascii
		$s4 = "\\update.dat" ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and $x1 or all of ($s*)

Full rule:
rule Mal_PotPlayer_DLL {
	meta:
		description = "Detects a malicious PotPlayer.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/13Wgy1"
		date = "2016-05-25"
		score = 70
		hash1 = "705409bc11fb45fa3c4e2fa9dd35af7d4613e52a713d9c6ea6bc4baff49aa74a"
		id = "71d34266-63e0-5a97-9a80-952be917641a"
	strings:
		$x1 = "C:\\Users\\john\\Desktop\\PotPlayer\\Release\\PotPlayer.pdb" fullword ascii

		$s3 = "PotPlayer.dll" fullword ascii
		$s4 = "\\update.dat" ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and $x1 or all of ($s*)
}
YARA Detection Rule: MAL_IcedID_Fake_GZIP_Bokbot_202104
Repository: Neo23x0/signature-base
Detects: Detects fake gzip provided by CC
Author: Thomas Barabosch, Telekom Security
Reference: https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240

Pattern signatures:
$gzip = {1f 8b 08 08 00 00 00 00 00 00 75 70 64 61 74 65}

Detection condition:
$gzip at 0

Full rule:
rule MAL_IcedID_Fake_GZIP_Bokbot_202104 {
   meta:
      author = "Thomas Barabosch, Telekom Security"
      date = "2021-04-20"
      description = "Detects fake gzip provided by CC"
      reference = "https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240"
      id = "538d84d8-aff2-571c-ba60-102f18262434"
   strings:
      $gzip = {1f 8b 08 08 00 00 00 00 00 00 75 70 64 61 74 65}
   condition:
      $gzip at 0
}