deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: SUSP_EXPL_Cleo_Exploitation_Log_Indicators_Dec24_1
Repository: Neo23x0/signature-base
Detects: Detects indicators found in logs during and after Cleo software exploitation (as reported by Huntress in December 2024)
Author: X__Junior
Reference: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild

Pattern signatures:
$sa1 = "<Thread type=\"AutoRun\" action=" ascii
      $sa2 = "<Mark date=" ascii
      $sa3 = "<Event>" ascii
      $sa4 = "<Command text" ascii

      $sb1 = "[System.Net.WebRequest]::create" ascii
      $sb2 = "Invoke-RestMethod" ascii
      $sb3 = "Invoke-WebRequest" ascii
      $sb4 = "iwr " ascii
      $sb5 = "Net.WebClient" ascii
      $sb6 = "Resume-BitsTransfer" ascii
      $sb7 = "Start-BitsTransfer" ascii
      $sb8 = "wget " ascii
      $sb9 = "WinHttp.WinHttpRequest" ascii
      $sb10 = ".DownloadFile(" ascii
      $sb11 = ".DownloadString(" ascii
      $sb12 = "Bypass" nocase ascii
      $sb13 = "-EncodedCommand" ascii
      $sb14 = "-windowstyle hidden" ascii
      $sb15 = " -enc " ascii

Detection condition:
filesize < 1MB
      and all of ($sa*)
      and 1 of ($sb*)

Full rule:
rule SUSP_EXPL_Cleo_Exploitation_Log_Indicators_Dec24_1 {
   meta:
      author = "X__Junior"
      description = "Detects indicators found in logs during and after Cleo software exploitation (as reported by Huntress in December 2024)"
      reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
      hash1 = "786951478a0fc5db24f6e1d8dcc5eaa8880dbd928da97828a61f1f1f0f21e21d"
      date = "2024-12-10"
      score = 75
      id = "81daf184-4c38-5d84-899b-9d0de2f39934"
   strings:
      $sa1 = "<Thread type=\"AutoRun\" action=" ascii
      $sa2 = "<Mark date=" ascii
      $sa3 = "<Event>" ascii
      $sa4 = "<Command text" ascii

      $sb1 = "[System.Net.WebRequest]::create" ascii
      $sb2 = "Invoke-RestMethod" ascii
      $sb3 = "Invoke-WebRequest" ascii
      $sb4 = "iwr " ascii
      $sb5 = "Net.WebClient" ascii
      $sb6 = "Resume-BitsTransfer" ascii
      $sb7 = "Start-BitsTransfer" ascii
      $sb8 = "wget " ascii
      $sb9 = "WinHttp.WinHttpRequest" ascii
      $sb10 = ".DownloadFile(" ascii
      $sb11 = ".DownloadString(" ascii
      $sb12 = "Bypass" nocase ascii
      $sb13 = "-EncodedCommand" ascii
      $sb14 = "-windowstyle hidden" ascii
      $sb15 = " -enc " ascii
   condition:
      filesize < 1MB
      and all of ($sa*)
      and 1 of ($sb*)
}
YARA Detection Rule: SUSP_EXPL_Cleo_Exploitation_Log_Indicators_Dec24_2
Repository: Neo23x0/signature-base
Detects: Detects indicators found in logs during and after Cleo software exploitation (as reported by Huntress in December 2024)
Author: X__Junior
Reference: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild

Pattern signatures:
$sa1 = "<Thread type=\"AutoRun\" action=" ascii
      $sa2 = "<Mark date=" ascii
      $sa3 = "<Event>" ascii
      $sa4 = "<Command text" ascii

      $sb1 = "wscript" ascii
      $sb2 = "cscript" ascii
      $sb3 = "mshta" ascii
      $sb4 = "certutil" ascii
      $sb5 = "pwsh" ascii
      $sb6 = "curl" ascii
      $sb7 = "msiexec" ascii
      $sb8 = "taskkill" ascii
      $sb9 = "regsvr32" ascii
      $sb10 = "rundll32" ascii
      $sb11 = "bitsadmin" ascii
      $sb12 = "whoami" ascii
      $sb13 = "bcdedit" ascii
      $sb14 = "systeminfo" ascii
      $sb15 = "reg " ascii
      $sb16 = "schtasks" ascii
      // $sb17 = "query" ascii

Detection condition:
filesize < 1MB
      and all of ($sa*)
      and 1 of ($sb*)

Full rule:
rule SUSP_EXPL_Cleo_Exploitation_Log_Indicators_Dec24_2 {
   meta:
      author = "X__Junior"
      description = "Detects indicators found in logs during and after Cleo software exploitation (as reported by Huntress in December 2024)"
      reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
      date = "2024-12-10"
      score = 70
      id = "d215d4a0-1726-58d4-90df-8ec6102effe1"
   strings:
      $sa1 = "<Thread type=\"AutoRun\" action=" ascii
      $sa2 = "<Mark date=" ascii
      $sa3 = "<Event>" ascii
      $sa4 = "<Command text" ascii

      $sb1 = "wscript" ascii
      $sb2 = "cscript" ascii
      $sb3 = "mshta" ascii
      $sb4 = "certutil" ascii
      $sb5 = "pwsh" ascii
      $sb6 = "curl" ascii
      $sb7 = "msiexec" ascii
      $sb8 = "taskkill" ascii
      $sb9 = "regsvr32" ascii
      $sb10 = "rundll32" ascii
      $sb11 = "bitsadmin" ascii
      $sb12 = "whoami" ascii
      $sb13 = "bcdedit" ascii
      $sb14 = "systeminfo" ascii
      $sb15 = "reg " ascii
      $sb16 = "schtasks" ascii
      // $sb17 = "query" ascii
   condition:
      filesize < 1MB
      and all of ($sa*)
      and 1 of ($sb*)
}
YARA Detection Rule: EXPL_Cleo_Exploitation_XML_Indicators_Dec24
Repository: Neo23x0/signature-base
Detects: Detects XML used during and after Cleo software exploitation (as reported by Huntress in December 2024)
Author: Florian Roth
Reference: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild

Pattern signatures:
$x1 = "<Host alias=\"60282967-dc91-40ef-a34c-38e992509c2c\" application=\"\" " ascii
      
      $s1 = "<Commands>SYSTEM cmd.exe /c " ascii
      $a1 = "<Action actiontype=\"Commands\" " ascii

Detection condition:
filesize < 50KB and (
         1 of ($x*)
         or 2 of them
      )

Full rule:
rule EXPL_Cleo_Exploitation_XML_Indicators_Dec24 {
   meta:
      description = "Detects XML used during and after Cleo software exploitation (as reported by Huntress in December 2024)"
      author = "Florian Roth"
      reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
      date = "2024-12-10"
      score = 70
      id = "622633af-aa7a-5bf9-a59c-6590535d86a4"
   strings:
      $x1 = "<Host alias=\"60282967-dc91-40ef-a34c-38e992509c2c\" application=\"\" " ascii
      
      $s1 = "<Commands>SYSTEM cmd.exe /c " ascii
      $a1 = "<Action actiontype=\"Commands\" " ascii
   condition:
      filesize < 50KB and (
         1 of ($x*)
         or 2 of them
      )
}
YARA Detection Rule: SUSP_EXPL_Cleo_Exploitation_XML_Indicators_Dec24_1
Repository: Neo23x0/signature-base
Detects: Detects XML used during and after Cleo software exploitation (as reported by Huntress in December 2024)
Author: X__Junior
Reference: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild

Pattern signatures:
$sa1 = "<Action actiontype=\"Commands\"" ascii
      $sa2 = "<?xml version=" ascii
      $sa3 = "<Runninglocalrequired>" ascii
      $sa4 = "<Autostartup>" ascii

      $sb1 = "[System.Net.WebRequest]::create" ascii
      $sb2 = "Invoke-RestMethod" ascii
      $sb3 = "Invoke-WebRequest" ascii
      $sb4 = "iwr " ascii
      $sb5 = "Net.WebClient" ascii
      $sb6 = "Resume-BitsTransfer" ascii
      $sb7 = "Start-BitsTransfer" ascii
      $sb8 = "wget " ascii
      $sb9 = "WinHttp.WinHttpRequest" ascii
      $sb10 = ".DownloadFile(" ascii
      $sb11 = ".DownloadString(" ascii
      $sb12 = "Bypass" nocase ascii
      $sb13 = "-EncodedCommand" ascii
      $sb14 = "-windowstyle hidden" ascii
      $sb15 = " -enc " ascii

Detection condition:
filesize < 10KB
      and all of ($sa*)
      and 1 of ($sb*)

Full rule:
rule SUSP_EXPL_Cleo_Exploitation_XML_Indicators_Dec24_1 {
   meta:
      author = "X__Junior"
      description = "Detects XML used during and after Cleo software exploitation (as reported by Huntress in December 2024)"
      reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
      hash1 = "b103f708e85416fc6d7af9605da4b57b3abe42fb9c6c9ec0f539b4c877580bd2"
      date = "2024-12-10"
      score = 70
      id = "b30ca09f-b84c-5de8-9bf7-9f3269f32c1f"
   strings:
      $sa1 = "<Action actiontype=\"Commands\"" ascii
      $sa2 = "<?xml version=" ascii
      $sa3 = "<Runninglocalrequired>" ascii
      $sa4 = "<Autostartup>" ascii

      $sb1 = "[System.Net.WebRequest]::create" ascii
      $sb2 = "Invoke-RestMethod" ascii
      $sb3 = "Invoke-WebRequest" ascii
      $sb4 = "iwr " ascii
      $sb5 = "Net.WebClient" ascii
      $sb6 = "Resume-BitsTransfer" ascii
      $sb7 = "Start-BitsTransfer" ascii
      $sb8 = "wget " ascii
      $sb9 = "WinHttp.WinHttpRequest" ascii
      $sb10 = ".DownloadFile(" ascii
      $sb11 = ".DownloadString(" ascii
      $sb12 = "Bypass" nocase ascii
      $sb13 = "-EncodedCommand" ascii
      $sb14 = "-windowstyle hidden" ascii
      $sb15 = " -enc " ascii
   condition:
      filesize < 10KB
      and all of ($sa*)
      and 1 of ($sb*)
}
YARA Detection Rule: SUSP_EXPL_Cleo_Exploitation_XML_Indicators_Dec24_2
Repository: Neo23x0/signature-base
Detects: Detects XML used during and after Cleo software exploitation (as reported by Huntress in December 2024)
Author: X__Junior
Reference: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild

Pattern signatures:
$sa1 = "<Action actiontype=\"Commands\"" ascii
      $sa2 = "<?xml version=" ascii
      $sa3 = "<Runninglocalrequired>" ascii
      $sa4 = "<Autostartup>" ascii

      $sb1 = "wscript" ascii
      $sb2 = "cscript" ascii
      $sb3 = "mshta" ascii
      $sb4 = "certutil" ascii
      $sb5 = "pwsh" ascii
      $sb6 = "curl" ascii
      $sb7 = "msiexec" ascii
      $sb8 = "taskkill" ascii
      $sb9 = "regsvr32" ascii
      $sb10 = "rundll32" ascii
      $sb11 = "bitsadmin" ascii
      $sb12 = "whoami" ascii
      $sb13 = "bcdedit" ascii
      $sb14 = "systeminfo" ascii
      $sb15 = "reg " ascii
      $sb16 = "schtasks" ascii
      // $sb17 = "query" ascii

Detection condition:
filesize < 10KB
      and all of ($sa*)
      and 1 of ($sb*)

Full rule:
rule SUSP_EXPL_Cleo_Exploitation_XML_Indicators_Dec24_2 {
   meta:
      author = "X__Junior"
      description = "Detects XML used during and after Cleo software exploitation (as reported by Huntress in December 2024)"
      reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
      date = "2024-12-10"
      score = 70
      id = "a71c71f3-d36f-5c27-b150-e678bccf2dba"
   strings:
      $sa1 = "<Action actiontype=\"Commands\"" ascii
      $sa2 = "<?xml version=" ascii
      $sa3 = "<Runninglocalrequired>" ascii
      $sa4 = "<Autostartup>" ascii

      $sb1 = "wscript" ascii
      $sb2 = "cscript" ascii
      $sb3 = "mshta" ascii
      $sb4 = "certutil" ascii
      $sb5 = "pwsh" ascii
      $sb6 = "curl" ascii
      $sb7 = "msiexec" ascii
      $sb8 = "taskkill" ascii
      $sb9 = "regsvr32" ascii
      $sb10 = "rundll32" ascii
      $sb11 = "bitsadmin" ascii
      $sb12 = "whoami" ascii
      $sb13 = "bcdedit" ascii
      $sb14 = "systeminfo" ascii
      $sb15 = "reg " ascii
      $sb16 = "schtasks" ascii
      // $sb17 = "query" ascii
   condition:
      filesize < 10KB
      and all of ($sa*)
      and 1 of ($sb*)
}
YARA Detection Rule: EXPL_Cleo_Exploitation_PS1_Indicators_Dec24
Repository: Neo23x0/signature-base
Detects: Detects encoded and decoded PowerShell loader used during Cleo software exploitation (as reported by Huntress in December 2024)
Author: Florian Roth
Reference: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild

Pattern signatures:
$xe1 = "Start-Process -WindowStyle Hidden -FilePath jre\\bin\\java.exe" base64 ascii wide
      $xe2 = "$f=\"cleo." base64 ascii wide
      $xe3 = "<Detail level=\"1\">Executing 'cmd.exe /c \"powershell -NonInteractive -EncodedCommand " base64 ascii wide

      $x1 = "$f=\"cleo." ascii wide
      $x2 = "<Detail level=\"1\">Executing 'cmd.exe /c \"powershell -NonInteractive -EncodedCommand " ascii wide

Detection condition:
1 of them

Full rule:
rule EXPL_Cleo_Exploitation_PS1_Indicators_Dec24 : SCRIPT {
   meta:
      description = "Detects encoded and decoded PowerShell loader used during Cleo software exploitation (as reported by Huntress in December 2024)"
      author = "Florian Roth"
      reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
      date = "2024-12-10"
      score = 75
      id = "491cda57-0ad0-5ddc-90cb-48411eef2f2e"
   strings:
      $xe1 = "Start-Process -WindowStyle Hidden -FilePath jre\\bin\\java.exe" base64 ascii wide
      $xe2 = "$f=\"cleo." base64 ascii wide
      $xe3 = "<Detail level=\"1\">Executing 'cmd.exe /c \"powershell -NonInteractive -EncodedCommand " base64 ascii wide

      $x1 = "$f=\"cleo." ascii wide
      $x2 = "<Detail level=\"1\">Executing 'cmd.exe /c \"powershell -NonInteractive -EncodedCommand " ascii wide
   condition:
      1 of them
}
YARA Detection Rule: SUSP_EXPL_JAR_Indicators_Dec24
Repository: Neo23x0/signature-base
Detects: Detects characteristics of JAR files used during Cleo software exploitation (as reported by Huntress in December 2024)
Author: Florian Roth
Reference: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild

Pattern signatures:
$s1 = "TLS v3 " ascii
      $s2 = "java/util/Base64$Decoder" ascii
      $s3 = "AES/CBC/NoPadding" ascii
      $s4 = "getenv" ascii
      $s5 = "ava/util/zip/ZipInputStream" ascii

Detection condition:
uint16(0) == 0xfeca
      and filesize < 20KB
      and all of them

Full rule:
rule SUSP_EXPL_JAR_Indicators_Dec24 {
   meta:
      description = "Detects characteristics of JAR files used during Cleo software exploitation (as reported by Huntress in December 2024)"
      author = "Florian Roth"
      reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
      date = "2024-12-10"
      score = 70
      id = "4e8f6aa8-9efd-5fcf-b795-5042d4ba1708"
   strings:
      $s1 = "TLS v3 " ascii
      $s2 = "java/util/Base64$Decoder" ascii
      $s3 = "AES/CBC/NoPadding" ascii
      $s4 = "getenv" ascii
      $s5 = "ava/util/zip/ZipInputStream" ascii
   condition:
      uint16(0) == 0xfeca
      and filesize < 20KB
      and all of them
}
YARA Detection Rule: EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_1_1
Repository: Neo23x0/signature-base
Detects: Detects characteristics of JAVA files used during Cleo software exploitation (as reported by Huntress in December 2024) - files Cli, ScSlot, Slot, SrvSlot
Author: Florian Roth
Reference: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild

Pattern signatures:
$a1 = "java/lang/StringBuffer"

      $x1 = "Start-Sleep 3;del " ascii
      $x2 = "sleep 3;rm -f '" ascii
      $x3 = "powershell -Noninteractive -EncodedCommand " ascii
      $x4 = "runDelFileCmd" ascii fullword

Detection condition:
uint16(0) == 0xfeca
      and filesize < 50KB
      and $a1
      and 1 of ($x*)

Full rule:
rule EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_1_1 {
   meta:
      description = "Detects characteristics of JAVA files used during Cleo software exploitation (as reported by Huntress in December 2024) - files Cli, ScSlot, Slot, SrvSlot"
      author = "Florian Roth"
      reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
      date = "2024-12-10"
      score = 75
      hash1 = "0c57b317b572d071afd8ccdb844dd6f117e20f818c6031d7ba8adcbd32be0617"
      id = "2940ddad-3dba-594a-9111-e4741d6ff39b"
   strings:
      $a1 = "java/lang/StringBuffer"

      $x1 = "Start-Sleep 3;del " ascii
      $x2 = "sleep 3;rm -f '" ascii
      $x3 = "powershell -Noninteractive -EncodedCommand " ascii
      $x4 = "runDelFileCmd" ascii fullword
   condition:
      uint16(0) == 0xfeca
      and filesize < 50KB
      and $a1
      and 1 of ($x*)
}
YARA Detection Rule: EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_2
Repository: Neo23x0/signature-base
Detects: Detects characteristics of JAVA files used during Cleo software exploitation (as reported by Huntress in December 2024) - file Proc
Author: Florian Roth
Reference: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild

Pattern signatures:
$s1 = "Timeout getting pipe-data" ascii fullword
      $s2 = "Ftprootpath" ascii fullword
      $s3 = "Rest cmd=" ascii fullword
      $s4 = "writeToProc" ascii fullword

Detection condition:
uint16(0) == 0xfeca
      and filesize < 30KB
      and 3 of them

Full rule:
rule EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_2 {
   meta:
      description = "Detects characteristics of JAVA files used during Cleo software exploitation (as reported by Huntress in December 2024) - file Proc"
      author = "Florian Roth"
      reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
      date = "2024-12-10"
      score = 75
      hash1 = "1ba95af21bac45db43ebf02f87ecedde802c7de4d472f33e74ee0a5b5015a726"
      id = "bd575454-7fd0-566d-94e5-ec[PII_REDACTED]"
   strings:
      $s1 = "Timeout getting pipe-data" ascii fullword
      $s2 = "Ftprootpath" ascii fullword
      $s3 = "Rest cmd=" ascii fullword
      $s4 = "writeToProc" ascii fullword
   condition:
      uint16(0) == 0xfeca
      and filesize < 30KB
      and 3 of them
}
YARA Detection Rule: EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_3
Repository: Neo23x0/signature-base
Detects: Detects characteristics of JAR files used during Cleo software exploitation
Author: X__Junior
Reference: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild

Pattern signatures:
$a1 = "java/lang/String" ascii

      $s1 = "#lsz#" ascii
      $s2 = "#dbg#" ascii
      $s3 = "#ll#" ascii
      $s4 = "SvZipDataOverflow=%d OpNotConf=" ascii

Detection condition:
uint16(0) == 0xfeca
      and filesize < 20KB
      and 3 of ($s*) and $a1

Full rule:
rule EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_3 {
   meta:
      description = "Detects characteristics of JAR files used during Cleo software exploitation"
      author = "X__Junior"
      reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
      date = "2024-12-10"
      score = 75
      id = "5c227bb9-0731-5955-a758-6fe86ecc2d86"
   strings:
      $a1 = "java/lang/String" ascii

      $s1 = "#lsz#" ascii
      $s2 = "#dbg#" ascii
      $s3 = "#ll#" ascii
      $s4 = "SvZipDataOverflow=%d OpNotConf=" ascii
   condition:
      uint16(0) == 0xfeca
      and filesize < 20KB
      and 3 of ($s*) and $a1
}
YARA Detection Rule: MAL_GandCrab_Apr18_1
Repository: Neo23x0/signature-base
Detects: Detects GandCrab malware
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/MarceloRivero/status/[PII_REDACTED]94550017

Detection condition:
uint16(0) == 0x5a4d and filesize < 800KB and pe.imphash() == "7936b0e9491fd747bf2675a7ec8af8ba"

Full rule:
rule MAL_GandCrab_Apr18_1 {
   meta:
      description = "Detects GandCrab malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/MarceloRivero/status/[PII_REDACTED]94550017"
      date = "2018-04-23"
      hash1 = "6fafe7bb56fd2696f2243fc305fe0c38f550dffcfc5fca04f[PII_REDACTED]0ffff"
      id = "ef7983cd-a7b3-5ce2-8cff-1bcf35bc6140"
   condition:
      uint16(0) == 0x5a4d and filesize < 800KB and pe.imphash() == "7936b0e9491fd747bf2675a7ec8af8ba"
}
YARA Detection Rule: Generic_Dropper
Repository: Neo23x0/signature-base
Detects: Detects Dropper PDB string in file
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/JAHZVL

Pattern signatures:
$s1 = "\\Release\\Dropper.pdb"
      $s2 = "\\Release\\dropper.pdb"
      $s3 = "\\Debug\\Dropper.pdb"
      $s4 = "\\Debug\\dropper.pdb"

Detection condition:
uint16(0) == 0x5a4d and filesize < 900KB and 1 of them

Full rule:
rule Generic_Dropper  {
   meta:
      description = "Detects Dropper PDB string in file"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/JAHZVL"
      date = "2018-03-03"
      id = "60ce6a5c-2e12-515b-b8cb-8c87500cb37b"
   strings:
      $s1 = "\\Release\\Dropper.pdb"
      $s2 = "\\Release\\dropper.pdb"
      $s3 = "\\Debug\\Dropper.pdb"
      $s4 = "\\Debug\\dropper.pdb"
   condition:
      uint16(0) == 0x5a4d and filesize < 900KB and 1 of them
}
YARA Detection Rule: VisualDiscovery_Lonovo_Superfish_SSL_Hijack
Repository: Neo23x0/signature-base
Detects: Lenovo Superfish SSL Interceptor - file VisualDiscovery.exe
Author: Florian Roth (Nextron Systems) / improved by kbandla
Reference: https://twitter.com/4nc4p/status/[PII_REDACTED]58272000

Pattern signatures:
//$s1 = "VisualDiscovery.exe" fullword wide
		$s2 = "Invalid key length used to initialize BlowFish." fullword ascii
		$s3 = "GetPCProxyHandler" fullword ascii
		$s4 = "StartPCProxy" fullword ascii
		$s5 = "SetPCProxyHandler" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 2MB and all of ($s*)

Full rule:
rule VisualDiscovery_Lonovo_Superfish_SSL_Hijack {
	meta:
		description = "Lenovo Superfish SSL Interceptor - file VisualDiscovery.exe"
		author = "Florian Roth (Nextron Systems) / improved by kbandla"
		reference = "https://twitter.com/4nc4p/status/[PII_REDACTED]58272000"
		date = "2015/02/19"
		hash1 = "99af9cfc7ab47f847103b5497b746407dc566963"
		hash2 = "f0b0cd0227ba302ac9ab4f30d837422c7ae66c46"
		hash3 = "f12edf2598d8f0732009c5cd1df5d2c559455a0b"
		hash4 = "343af97d47582c8150d63cbced601113b14fcca6"
		id = "200c016e-7ad8-5b58-be5f-7866e91d60e9"
	strings:
		//$s1 = "VisualDiscovery.exe" fullword wide
		$s2 = "Invalid key length used to initialize BlowFish." fullword ascii
		$s3 = "GetPCProxyHandler" fullword ascii
		$s4 = "StartPCProxy" fullword ascii
		$s5 = "SetPCProxyHandler" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 2MB and all of ($s*)
}
YARA Detection Rule: APT_LNX_Academic_Camp_May20_Eraser_1
Repository: Neo23x0/signature-base
Detects: Detects malware used in attack on academic data centers
Author: Florian Roth (Nextron Systems)
Reference: https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/

Pattern signatures:
$sc2 = { E6 FF FF 48 89 45 D0 8B 45 E0 BA 00 00 00 00 BE
               00 00 00 00 89 C7 E8 }
      $sc3 = { E6 FF FF 89 45 DC 8B 45 DC 83 C0 01 48 98 BE 01
               00 00 00 48 89 C7 E8 }

Detection condition:
uint16(0) == 0x457f and
      filesize < 60KB and
      all of them

Full rule:
rule APT_LNX_Academic_Camp_May20_Eraser_1 {
   meta:
      description = "Detects malware used in attack on academic data centers"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/"
      date = "2020-05-16"
      hash1 = "552245645cc49087dfbc827d069fa678626b946f4b71cb35fa4a49becd971363"
      id = "36d17887-9844-5fa4-8a0d-89cc41b2d876"
   strings:
      $sc2 = { E6 FF FF 48 89 45 D0 8B 45 E0 BA 00 00 00 00 BE
               00 00 00 00 89 C7 E8 }
      $sc3 = { E6 FF FF 89 45 DC 8B 45 DC 83 C0 01 48 98 BE 01
               00 00 00 48 89 C7 E8 }
   condition:
      uint16(0) == 0x457f and
      filesize < 60KB and
      all of them
}