deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: apt_hellsing_xkat
Repository: Neo23x0/signature-base
Detects: detection for Hellsing xKat tool
Author: Costin Raiu, Kaspersky Lab

Pattern signatures:
$a1 = "\\Dbgv.sys" $a2="XKAT_BIN" $a3="release sys file error."
		$a4 = "driver_load error. "
		$a5 = "driver_create error."
		$a6 = "delete file:%s error." 
		$a7 = "delete file:%s ok."
		$a8 = "kill pid:%d error."
		$a9 = "kill pid:%d ok."
		$a10 = "-pid-delete"
		$a11 = "kill and delete pid:%d error."
		$a12 = "kill and delete pid:%d ok."

Detection condition:
uint16(0) == 0x5a4d and (6 of ($a*)) and filesize < 300000

Full rule:
rule apt_hellsing_xkat { 
	meta:
		version = "1.0"
		filetype = "PE"
		author = "Costin Raiu, Kaspersky Lab" copyright = "Kaspersky Lab"
		date = "2015-04-07"
		description = "detection for Hellsing xKat tool"
		id = "c831ce04-8fb2-5790-8aaf-c88b370835ac"
	strings: 
		$a1 = "\\Dbgv.sys" $a2="XKAT_BIN" $a3="release sys file error."
		$a4 = "driver_load error. "
		$a5 = "driver_create error."
		$a6 = "delete file:%s error." 
		$a7 = "delete file:%s ok."
		$a8 = "kill pid:%d error."
		$a9 = "kill pid:%d ok."
		$a10 = "-pid-delete"
		$a11 = "kill and delete pid:%d error."
		$a12 = "kill and delete pid:%d ok."
	condition:
		uint16(0) == 0x5a4d and (6 of ($a*)) and filesize < 300000
}
YARA Detection Rule: apt_hellsing_msgertype2
Repository: Neo23x0/signature-base
Detects: detection for Hellsing msger type 2 implants
Author: Costin Raiu, Kaspersky Lab

Pattern signatures:
$a1 = "%s\\system\\%d.txt"
		$a2 = "_msger" 
		$a3 = "http://%s/lib/common.asp?action=user_login&uid=%s&lan=%s&host=%s&os=%s&proxy=%s"
		$a4 = "http://%s/data/%s[PII_REDACTED]" 
		$a5 = "/lib/common.asp?action=user_upload&file="
		$a6 = "%02X-%02X-%02X-%02X-%02X-%02X"

Detection condition:
uint16(0) == 0x5a4d and (4 of ($a*)) and filesize < 500000

Full rule:
rule apt_hellsing_msgertype2 { 
	meta:
		version = "1.0"
		filetype = "PE"
		author = "Costin Raiu, Kaspersky Lab"
		copyright = "Kaspersky Lab"
		date = "2015-04-07"
		description = "detection for Hellsing msger type 2 implants"
		id = "98f151de-c1c2-56c1-8c64-5d1f437e0742"
	strings: 
		$a1 = "%s\\system\\%d.txt"
		$a2 = "_msger" 
		$a3 = "http://%s/lib/common.asp?action=user_login&uid=%s&lan=%s&host=%s&os=%s&proxy=%s"
		$a4 = "http://%s/data/%s[PII_REDACTED]" 
		$a5 = "/lib/common.asp?action=user_upload&file="
		$a6 = "%02X-%02X-%02X-%02X-%02X-%02X"
	condition:
		uint16(0) == 0x5a4d and (4 of ($a*)) and filesize < 500000
}
YARA Detection Rule: apt_hellsing_irene
Repository: Neo23x0/signature-base
Detects: detection for Hellsing msger irene installer
Author: Costin Raiu, Kaspersky Lab

Pattern signatures:
$a1 = "\\Drivers\\usbmgr.tmp" wide
		$a2 = "\\Drivers\\usbmgr.sys" wide
		$a3 = "common_loadDriver CreateFile error!"
		$a4 = "common_loadDriver StartService error && GetLastError():%d!"
		$a5 = "irene" wide
		$a6 = "aPLib v0.43 - the smaller the better"

Detection condition:
uint16(0) == 0x5a4d and (4 of ($a*)) and filesize < 500000

Full rule:
rule apt_hellsing_irene { 
	meta:
		version = "1.0"
		filetype = "PE"
		author = "Costin Raiu, Kaspersky Lab"
		copyright = "Kaspersky Lab"
		date = "2015-04-07"
		description = "detection for Hellsing msger irene installer"
		id = "b57d1a10-4e5c-511f-b98c-8ce7d766c227"
	strings: 
		$a1 = "\\Drivers\\usbmgr.tmp" wide
		$a2 = "\\Drivers\\usbmgr.sys" wide
		$a3 = "common_loadDriver CreateFile error!"
		$a4 = "common_loadDriver StartService error && GetLastError():%d!"
		$a5 = "irene" wide
		$a6 = "aPLib v0.43 - the smaller the better" 
	condition:
		uint16(0) == 0x5a4d and (4 of ($a*)) and filesize < 500000
}
YARA Detection Rule: CMStar_Malware_Sep17
Repository: Neo23x0/signature-base
Detects: Detects CMStar Malware
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/pTffPA

Pattern signatures:
$s1 = "UpdateService.tmp" fullword ascii
      $s2 = "StateNum:%d,FileSize:%d" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and (
         pe.imphash() == "22021985de78a48ea8fb82a2ff9eb693" or
         pe.exports("WinCred") or
         all of them
      )

Full rule:
rule CMStar_Malware_Sep17 {
   meta:
      description = "Detects CMStar Malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/pTffPA"
      date = "2017-10-03"
      hash1 = "16697c95db5add6c1c23b2591b9d8eec5ed96074d057b9411f0b57a54af298d5"
      id = "d6c9cd7f-06ce-5641-b9b2-c81daf18628d"
   strings:
      $s1 = "UpdateService.tmp" fullword ascii
      $s2 = "StateNum:%d,FileSize:%d" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 100KB and (
         pe.imphash() == "22021985de78a48ea8fb82a2ff9eb693" or
         pe.exports("WinCred") or
         all of them
      )
}
YARA Detection Rule: Impacket_Tools_tracer
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s1 = "btk85.dll" fullword ascii
      $s2 = "btcl85.dll" fullword ascii
      $s3 = "xtk\\unsupported.tcl" fullword ascii

      $fp1 = "Linden Research Inc" wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 21000KB and all of ($s*) )
      and not 1 of ($fp*)

Full rule:
rule Impacket_Tools_tracer {
   meta:
      description = "Compiled Impacket Tools"
      author = "Florian Roth"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      modified = "2021-07-15"
      hash1 = "e300339058a885475f5952fb4e9faaa09bb6eac[PII_REDACTED]7b281c46b03108b"
   strings:
      $s1 = "btk85.dll" fullword ascii
      $s2 = "btcl85.dll" fullword ascii
      $s3 = "xtk\\unsupported.tcl" fullword ascii

      $fp1 = "Linden Research Inc" wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 21000KB and all of ($s*) )
      and not 1 of ($fp*)
}
YARA Detection Rule: Impacket_Tools_wmiexec
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s1 = "bwmiexec.exe.manifest" fullword ascii
      $s2 = "swmiexec" fullword ascii
      $s3 = "\\yzHPlU=QA" ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 17000KB and 2 of them )

Full rule:
rule Impacket_Tools_wmiexec {
   meta:
      description = "Compiled Impacket Tools"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      hash1 = "[PII_REDACTED]341fe7276c59d85f4aa[PII_REDACTED]ca9c98f8a9e7307c290bad4"
      id = "3c2c7edf-da71-53dc-9ddf-dfbf10838a27"
   strings:
      $s1 = "bwmiexec.exe.manifest" fullword ascii
      $s2 = "swmiexec" fullword ascii
      $s3 = "\\yzHPlU=QA" ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 17000KB and 2 of them )
}
YARA Detection Rule: Impacket_Tools_sniffer
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s1 = "ssniffer" fullword ascii
      $s2 = "impacket.dhcp(" ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 15000KB and all of them )

Full rule:
rule Impacket_Tools_sniffer {
   meta:
      description = "Compiled Impacket Tools"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      hash1 = "efff15e1815fb3c156678417d6037ddf4b711a3122c9b5bc2ca8dc97165d3769"
      id = "07051edc-91a8-59d6-87bf-dba98ef28588"
   strings:
      $s1 = "ssniffer" fullword ascii
      $s2 = "impacket.dhcp(" ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 15000KB and all of them )
}
YARA Detection Rule: Impacket_Tools_mmcexec
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s1 = "smmcexec" fullword ascii
      $s2 = "\\yzHPlU=QA" ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 16000KB and all of them )

Full rule:
rule Impacket_Tools_mmcexec {
   meta:
      description = "Compiled Impacket Tools"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      hash1 = "263a1655a94b7920531e123a8c9737428f2988bf58156c62408e192d4b2a63fc"
      id = "cca2082f-72a4-50c8-80b8-a9bed430dc4e"
   strings:
      $s1 = "smmcexec" fullword ascii
      $s2 = "\\yzHPlU=QA" ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 16000KB and all of them )
}
YARA Detection Rule: Impacket_Tools_ifmap
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s1 = "bifmap.exe.manifest" fullword ascii
      $s2 = "impacket.dcerpc.v5.epm(" ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 15000KB and all of them )

Full rule:
rule Impacket_Tools_ifmap {
   meta:
      description = "Compiled Impacket Tools"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      hash1 = "20a1f11788e6cc98a76dca2db4691963c054fc12a4d608ac41739b98f84b3613"
      id = "e5461916-ec2b-5f65-b938-267483f50bb2"
   strings:
      $s1 = "bifmap.exe.manifest" fullword ascii
      $s2 = "impacket.dcerpc.v5.epm(" ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 15000KB and all of them )
}
YARA Detection Rule: karmaSMB
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s1 = "bkarmaSMB.exe.manifest" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )

Full rule:
rule karmaSMB {
   meta:
      description = "Compiled Impacket Tools"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      hash1 = "d256d1e05695d62a86d9e76830fcbb856ba7bd578165a561edd43b9f7fdb18a3"
      id = "32c810c7-02e7-5203-b2ed-4e930b318cc0"
   strings:
      $s1 = "bkarmaSMB.exe.manifest" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
}
YARA Detection Rule: samrdump
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s2 = "bsamrdump.exe.manifest" fullword ascii
      $s3 = "ssamrdump" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )

Full rule:
rule samrdump {
   meta:
      description = "Compiled Impacket Tools"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      hash1 = "4c2921702d18e0874b[PII_REDACTED]4e54719ee6dfa39d323839d216952c5c834a"
      id = "cd274719-c8cc-5882-8d75-192ad822c6b3"
   strings:
      $s2 = "bsamrdump.exe.manifest" fullword ascii
      $s3 = "ssamrdump" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
}
YARA Detection Rule: Impacket_Tools_rpcdump
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s1 = "srpcdump" fullword ascii
      $s2 = "impacket.dcerpc.v5.epm(" ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )

Full rule:
rule Impacket_Tools_rpcdump {
   meta:
      description = "Compiled Impacket Tools"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      hash1 = "21d85b36197db47b94b0f4995d07b040a0455ebbe6d413bc33d926ee4e0315d9"
      id = "3f998aa6-c260-5fef-99ef-e8b4770c68c6"
   strings:
      $s1 = "srpcdump" fullword ascii
      $s2 = "impacket.dcerpc.v5.epm(" ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
}
YARA Detection Rule: Impacket_Tools_secretsdump
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s1 = "ssecretsdump" fullword ascii
      $s2 = "impacket.ese(" ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )

Full rule:
rule Impacket_Tools_secretsdump {
   meta:
      description = "Compiled Impacket Tools"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      hash1 = "47afa5fd954190df825924c55112e65fd8ed0f7e1d6fd403ede[PII_REDACTED]d7d"
      id = "c944d051-ea24-5595-abef-59e326ad56de"
   strings:
      $s1 = "ssecretsdump" fullword ascii
      $s2 = "impacket.ese(" ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
}
YARA Detection Rule: Impacket_Tools_esentutl
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s1 = "impacket.ese(" ascii
      $s2 = "sesentutl" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 11000KB and all of them )

Full rule:
rule Impacket_Tools_esentutl {
   meta:
      description = "Compiled Impacket Tools"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      hash1 = "70d854953d3ebb2c252783a4a103ba0e596d6ab447f238af777fb37d2b64c0cd"
      id = "1965e2b3-54be-553a-83d6-a0d4919414dd"
   strings:
      $s1 = "impacket.ese(" ascii
      $s2 = "sesentutl" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 11000KB and all of them )
}
YARA Detection Rule: Impacket_Tools_opdump
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s2 = "bopdump.exe.manifest" fullword ascii
      $s3 = "sopdump" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )

Full rule:
rule Impacket_Tools_opdump {
   meta:
      description = "Compiled Impacket Tools"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      hash1 = "e2205539f29972d4e2a83eabf92af18dd406c9be97f70661c336ddf5eb496742"
      id = "1bb0e747-e9b7-5a54-8052-428351be8d0d"
   strings:
      $s2 = "bopdump.exe.manifest" fullword ascii
      $s3 = "sopdump" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
}
YARA Detection Rule: Impacket_Tools_sniff
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s1 = "ssniff" fullword ascii
      $s2 = "impacket.eap(" ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 15000KB and all of them )

Full rule:
rule Impacket_Tools_sniff {
   meta:
      description = "Compiled Impacket Tools"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      hash1 = "8ab2b60aadf97e921e3a9df5cf1c135fbc851cb66d09b1043eaaa1dc01b9a699"
      id = "07051edc-91a8-59d6-87bf-dba98ef28588"
   strings:
      $s1 = "ssniff" fullword ascii
      $s2 = "impacket.eap(" ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 15000KB and all of them )
}
YARA Detection Rule: Impacket_Tools_smbexec
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s1 = "logging.config(" ascii
      $s2 = "ssmbexec" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )

Full rule:
rule Impacket_Tools_smbexec {
   meta:
      description = "Compiled Impacket Tools"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      hash1 = "7d715217e23a471d42d95c624179fe7de085af5670171d212b7b798ed9bf07c2"
      id = "02208817-2eab-54e2-90cf-44dbf5474607"
   strings:
      $s1 = "logging.config(" ascii
      $s2 = "ssmbexec" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
}
YARA Detection Rule: Impacket_Tools_goldenPac
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s1 = "impacket.examples.serviceinstall(" ascii
      $s2 = "bgoldenPac.exe" fullword ascii
      $s3 = "json.scanner(" ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )

Full rule:
rule Impacket_Tools_goldenPac {
   meta:
      description = "Compiled Impacket Tools"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      hash1 = "4f7fad0676d3c3d2d89e8d4e74b6ec40af731b1ddf5499a0b81fc3b1cd797ee3"
      id = "9894d16c-83fa-5e1d-9ca6-572deeec006a"
   strings:
      $s1 = "impacket.examples.serviceinstall(" ascii
      $s2 = "bgoldenPac.exe" fullword ascii
      $s3 = "json.scanner(" ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
}
YARA Detection Rule: Impacket_Tools_netview
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s1 = "impacket.dcerpc.v5.wkst(" ascii
      $s2 = "dummy_threading(" ascii
      $s3 = "snetview" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )

Full rule:
rule Impacket_Tools_netview {
   meta:
      description = "Compiled Impacket Tools"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      hash1 = "ab909f8082c2d04f73d8be8f4c2640a[PII_REDACTED]dffdcc85e83a39d20c49ed6"
      id = "1b9238d2-b9b1-5633-8481-05a3a97af5a6"
   strings:
      $s1 = "impacket.dcerpc.v5.wkst(" ascii
      $s2 = "dummy_threading(" ascii
      $s3 = "snetview" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
}
YARA Detection Rule: Impacket_Tools_smbtorture
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s1 = "impacket" fullword ascii
      $s2 = "ssmbtorture" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )

Full rule:
rule Impacket_Tools_smbtorture {
   meta:
      description = "Compiled Impacket Tools"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      hash1 = "d2856e[PII_REDACTED]3e5b335cb46b713b1a6b2c414966a9de122ee7fb226aa7f7"
      id = "4f9b55e2-93ce-5d08-a228-73233fb0a2c6"
   strings:
      $s1 = "impacket" fullword ascii
      $s2 = "ssmbtorture" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
}
YARA Detection Rule: Impacket_Tools_mimikatz
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s1 = "impacket" fullword ascii
      $s2 = "smimikatz" fullword ascii
      $s3 = "otwsdlc" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )

Full rule:
rule Impacket_Tools_mimikatz {
   meta:
      description = "Compiled Impacket Tools"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      hash1 = "2d8d500bcb3ffd22ddd8bd68b5b2ce935c958304f03729442a20a28b2c0328c1"
      id = "0b1f5ad0-7070-58d5-946f-157dcb9627ab"
   strings:
      $s1 = "impacket" fullword ascii
      $s2 = "smimikatz" fullword ascii
      $s3 = "otwsdlc" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
}
YARA Detection Rule: Impacket_Tools_smbrelayx
Repository: Neo23x0/signature-base
Detects: Compiled Impacket Tools
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/maaaaz/impacket-examples-windows

Pattern signatures:
$s1 = "impacket.examples.secretsdump" fullword ascii
      $s2 = "impacket.examples.serviceinstall" fullword ascii
      $s3 = "impacket.smbserver(" ascii
      $s4 = "SimpleHTTPServer(" ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 18000KB and 3 of them )

Full rule:
rule Impacket_Tools_smbrelayx {
   meta:
      description = "Compiled Impacket Tools"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/maaaaz/impacket-examples-windows"
      date = "2017-04-07"
      hash1 = "9706eb99e48e445ac4240b5acb2efd49468a800913e70e40b25c2bf80d6be35f"
      id = "84abf3cf-841c-592d-a9d1-71d5e76eb43f"
   strings:
      $s1 = "impacket.examples.secretsdump" fullword ascii
      $s2 = "impacket.examples.serviceinstall" fullword ascii
      $s3 = "impacket.smbserver(" ascii
      $s4 = "SimpleHTTPServer(" ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 18000KB and 3 of them )
}