deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT_APT29_sorefang_modify_alphabet_custom_encode
Repository: Neo23x0/signature-base
Detects: Rule to detect SoreFang based on arguments passed into custom encoding algorithm function
Author: NCSC
Reference: https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development

Pattern signatures:
$ = { 33 C0 8B CE 6A 36 6A 71 66 89 46 60 88 46 62 89 46 68 66 89 46
            64 }

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and any of them

Full rule:
rule APT_APT29_sorefang_modify_alphabet_custom_encode { 
   meta:
      description = "Rule to detect SoreFang based on arguments passed into custom encoding algorithm function"
      author = "NCSC"
      reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
      hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
      id = "7c5c1be0-ccad-5c8f-a026-445994b1f279"
   strings:
      $ = { 33 C0 8B CE 6A 36 6A 71 66 89 46 60 88 46 62 89 46 68 66 89 46
            64 }
   condition:
      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and any of them
}
YARA Detection Rule: APT_APT29_sorefang_custom_encode_decode
Repository: Neo23x0/signature-base
Detects: Rule to detect SoreFang based on the custom encoding/decoding algorithm function
Author: NCSC
Reference: https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development

Pattern signatures:
$ = { 55 8B EC 8B D1 53 56 8B 75 08 8B DE 80 42 62 FA 8A 4A 62 66 D3
            EB 57 3A 5A 5C 74 0F}
      $ = { 3A 5A 5D 74 0A 3A 5A 58 74 05 3A 5A 59 75 05 FE C1 88 4A 62 8A 
            4A 62 B8 01 00 00 00}
      $ = { 8A 46 62 84 C0 74 3E 3C 06 73 12 0F B6 C0 B9 06 00 00 00 2B C8 
            C6 46 62 06 66 D3 66 60 0F B7 4E 60}
      $ = { 80 3C 38 0D 0F 84 93 01 00 00 C6 42 62 06 8B 56 14 83 FA 10 72 
            04 8B 06}
      $ = { 0F BE 0C 38 8B 45 EC 0F B6 40 5B 3B C8 75 07 8B 55 EC B3 3E}
      $ = { 0F BE 0C 38 8B 45 EC 0F B6 40 5E 3B C8 75 0B 8B 55 EC D0 EB C6 
            42 62 05}
      $ = { 8B 55 EC 0F BE 04 38 0F B6 DB 0F B6 4A 5F 3B C1 B8 3F 00 00 00 
            0F 44 D8}
      $ = { 8A 4A 62 66 8B 52 60 66 D3 E2 0F B6 C3 66 0B D0 8B 45 EC 66 89 
            50 60 8A 45 F3 02 C1 88 45 F3 3C 08 72 2E 04 F8 8A C8 88 45 F3 
            66 D3 EA 8B 4D 08 0F B6 C2 50 }
      $ = { 3A 5A 5C 74 0F 3A 5A 5D 74 0A 3A 5A 58 74 05 3A 5A 59 75 05 FE 
            C1 88 4A 62

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) 
      and any of them

Full rule:
rule APT_APT29_sorefang_custom_encode_decode {
   meta:
      description = "Rule to detect SoreFang based on the custom encoding/decoding algorithm function"
      author = "NCSC"
      reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
      hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
      id = "4885a659-bb3a-5e33-99cc-b827931bf58f"
   strings:
      $ = { 55 8B EC 8B D1 53 56 8B 75 08 8B DE 80 42 62 FA 8A 4A 62 66 D3
            EB 57 3A 5A 5C 74 0F}
      $ = { 3A 5A 5D 74 0A 3A 5A 58 74 05 3A 5A 59 75 05 FE C1 88 4A 62 8A 
            4A 62 B8 01 00 00 00}
      $ = { 8A 46 62 84 C0 74 3E 3C 06 73 12 0F B6 C0 B9 06 00 00 00 2B C8 
            C6 46 62 06 66 D3 66 60 0F B7 4E 60}
      $ = { 80 3C 38 0D 0F 84 93 01 00 00 C6 42 62 06 8B 56 14 83 FA 10 72 
            04 8B 06}
      $ = { 0F BE 0C 38 8B 45 EC 0F B6 40 5B 3B C8 75 07 8B 55 EC B3 3E}
      $ = { 0F BE 0C 38 8B 45 EC 0F B6 40 5E 3B C8 75 0B 8B 55 EC D0 EB C6 
            42 62 05}
      $ = { 8B 55 EC 0F BE 04 38 0F B6 DB 0F B6 4A 5F 3B C1 B8 3F 00 00 00 
            0F 44 D8}
      $ = { 8A 4A 62 66 8B 52 60 66 D3 E2 0F B6 C3 66 0B D0 8B 45 EC 66 89 
            50 60 8A 45 F3 02 C1 88 45 F3 3C 08 72 2E 04 F8 8A C8 88 45 F3 
            66 D3 EA 8B 4D 08 0F B6 C2 50 }
      $ = { 3A 5A 5C 74 0F 3A 5A 5D 74 0A 3A 5A 58 74 05 3A 5A 59 75 05 FE 
            C1 88 4A 62 }
   condition:
      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) 
      and any of them 
}
YARA Detection Rule: APT_APT29_sorefang_remove_chars_comma_space_dot
Repository: Neo23x0/signature-base
Detects: Rule to detect SoreFang based on function that removes commas, spaces and dots
Author: NCSC
Reference: https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development

Pattern signatures:
$ = {8A 18 80 FB 2C 74 03 88 19 41 42 40 3B D6 75 F0 8B 5D 08} 
      $ = {8A 18 80 FB 2E 74 03 88 19 41 42 40 3B D6 75 F0 8B 5D 08} 
      $ = {8A 18 80 FB 20 74 03 88 19 41 42 40 3B D6 75 F0 8B 5D 08}

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them

Full rule:
rule APT_APT29_sorefang_remove_chars_comma_space_dot { 
   meta:
      description = "Rule to detect SoreFang based on function that removes commas, spaces and dots"
      author = "NCSC"
      reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
      hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
      id = "c15779b0-6a5e-5345-94ad-95615b567f1f"
   strings:
      $ = {8A 18 80 FB 2C 74 03 88 19 41 42 40 3B D6 75 F0 8B 5D 08} 
      $ = {8A 18 80 FB 2E 74 03 88 19 41 42 40 3B D6 75 F0 8B 5D 08} 
      $ = {8A 18 80 FB 20 74 03 88 19 41 42 40 3B D6 75 F0 8B 5D 08}
   condition:
      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them 
}
YARA Detection Rule: APT_APT29_sorefang_disk_enumeration_strings
Repository: Neo23x0/signature-base
Detects: Rule to detect SoreFang based on disk enumeration strings
Author: NCSC
Reference: https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development

Pattern signatures:
$ = "\x0D\x0AFree on disk: "
      $ = "Total disk: "
      $ = "Error in GetDiskFreeSpaceEx\x0D\x0A"
      $ = "\x0D\x0AVolume label: "
      $ = "Serial number: "
      $ = "File system: "
      $ = "Error in GetVolumeInformation\x0D\x0A"
      $ = "I can not het information about this disk\x0D\x0A"

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) 
      and all of them

Full rule:
rule APT_APT29_sorefang_disk_enumeration_strings { 
   meta:
      description = "Rule to detect SoreFang based on disk enumeration strings"
      author = "NCSC"
      reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
      hash = "a4b790ddffb3d2e6691dcacae08fb0bfa1ae56b6c73d70688b097ffa831af064" 
      id = "0ff01793-6fb7-5cff-b4e4-6709269ab0f0"
   strings:
      $ = "\x0D\x0AFree on disk: "
      $ = "Total disk: "
      $ = "Error in GetDiskFreeSpaceEx\x0D\x0A"
      $ = "\x0D\x0AVolume label: "
      $ = "Serial number: "
      $ = "File system: "
      $ = "Error in GetVolumeInformation\x0D\x0A"
      $ = "I can not het information about this disk\x0D\x0A"
   condition:
      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) 
      and all of them 
}
YARA Detection Rule: CVE_2015_1674_CNGSYS
Repository: Neo23x0/signature-base
Detects: Detects exploits for CVE-2015-1674
Author: Florian Roth (Nextron Systems)
Reference: http://www.binvul.com/viewthread.php?tid=508

Pattern signatures:
$s1 = "\\Device\\CNG" wide
		
		$s2 = "GetProcAddress" fullword ascii
		$s3 = "LoadLibrary" ascii
		$s4 = "KERNEL32.dll" fullword ascii
		$s5 = "ntdll.dll" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 60KB and all of them

Full rule:
rule CVE_2015_1674_CNGSYS {
	meta:
		description = "Detects exploits for CVE-2015-1674"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.binvul.com/viewthread.php?tid=508"
		date = "2015-05-14"
		hash = "af4eb2a275f6bbc2bfeef656642ede9ce04fad36"
		id = "1161b395-a19e-5aac-8416-8a4e60aeca37"
	strings:
		$s1 = "\\Device\\CNG" wide
		
		$s2 = "GetProcAddress" fullword ascii
		$s3 = "LoadLibrary" ascii
		$s4 = "KERNEL32.dll" fullword ascii
		$s5 = "ntdll.dll" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 60KB and all of them
}
YARA Detection Rule: SUSP_LNK_Big_Link_File
Repository: Neo23x0/signature-base
Detects: Detects a suspiciously big LNK file - maybe with embedded content
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Detection condition:
uint16(0) == 0x004c and uint32(4) == 0x00021401 and filesize > 200KB

Full rule:
rule SUSP_LNK_Big_Link_File {
   meta:
      description = "Detects a suspiciously big LNK file - maybe with embedded content"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2018-05-15"
      score = 65
      id = "e130f213-53fc-56d6-b1d5-0508a7e18e61"
   condition:
      uint16(0) == 0x004c and uint32(4) == 0x00021401 and filesize > 200KB
}
YARA Detection Rule: SUSP_Hunt_EvtMuteHook_Memory
Repository: Neo23x0/signature-base
Detects: Memory hunt for default wevtsv EtwEventCallback hook pattern to apply to eventlog svchost memory dump
Author: SBousseaden
Reference: https://blog.dylan.codes/pwning-windows-event-logging/

Pattern signatures:
$a = {49 BB ?? ?? ?? ?? ?? ?? ?? ?? 41 FF E3 54 24 20 4C 8B 05 61 CB 1A 00 0F 57 C0 66 0F 7F 44 24 20 E8 5B 0A 00 00 48 83 C4 38 C3}
        $b = {48 83 EC 38 4C 8B 0D 65 CB 1A 00 48 8D 54 24 20 4C 8B 05 61 CB 1A 00 0F 57 C0 66 0F 7F 44 24 20 E8 5B 0A 00 00 48 83 C4 38 C3}

Detection condition:
$a and not $b

Full rule:
rule SUSP_Hunt_EvtMuteHook_Memory {
    meta:
        description = "Memory hunt for default wevtsv EtwEventCallback hook pattern to apply to eventlog svchost memory dump"
        reference = "https://blog.dylan.codes/pwning-windows-event-logging/"
        author = "SBousseaden"
        date = "2020-09-05"
        score = 70
        id = "5326581e-90d9-59b9-8dc5-74df97571600"
    strings:
        $a = {49 BB ?? ?? ?? ?? ?? ?? ?? ?? 41 FF E3 54 24 20 4C 8B 05 61 CB 1A 00 0F 57 C0 66 0F 7F 44 24 20 E8 5B 0A 00 00 48 83 C4 38 C3}
        $b = {48 83 EC 38 4C 8B 0D 65 CB 1A 00 48 8D 54 24 20 4C 8B 05 61 CB 1A 00 0F 57 C0 66 0F 7F 44 24 20 E8 5B 0A 00 00 48 83 C4 38 C3}
    condition: 
        $a and not $b
}
YARA Detection Rule: CrunchRAT
Repository: Neo23x0/signature-base
Detects: Detects CrunchRAT - file CrunchRAT.exe
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/t3ntman/CrunchRAT

Pattern signatures:
$x1 = "----CrunchRAT" fullword wide
      $x2 = "\\Debug\\CrunchRAT" ascii
      $x3 = "\\Release\\CrunchRAT" ascii

      $s1 = "runCommand" fullword ascii
      $s2 = "<action>download<action>" fullword wide
      $s3 = "Content-Disposition: form-data; name=action" fullword wide
      $s4 = "<action>upload<action>" fullword wide
      $s5 = "/update.php" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 40KB and ( 1 of ($x*) and 3 of them )

Full rule:
rule CrunchRAT {
   meta:
      description = "Detects CrunchRAT - file CrunchRAT.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/t3ntman/CrunchRAT"
      date = "2017-11-03"
      hash1 = "58a07e96497745b6fd5075d569f17b0254c3e50b0234744e0487f7c5dddf7161"
      id = "da7d9b5c-6ccc-5960-9daa-4df612545751"
   strings:
      $x1 = "----CrunchRAT" fullword wide
      $x2 = "\\Debug\\CrunchRAT" ascii
      $x3 = "\\Release\\CrunchRAT" ascii

      $s1 = "runCommand" fullword ascii
      $s2 = "<action>download<action>" fullword wide
      $s3 = "Content-Disposition: form-data; name=action" fullword wide
      $s4 = "<action>upload<action>" fullword wide
      $s5 = "/update.php" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 40KB and ( 1 of ($x*) and 3 of them )
}
YARA Detection Rule: crime_win_rat_AlienSpy
Repository: Neo23x0/signature-base
Detects: Alien Spy Remote Access Trojan
Author: General Dynamics Fidelis Cybersecurity Solutions - Threat Research Team

Pattern signatures:
$sa_1 = "META-INF/MANIFEST.MF"
        $sa_2 = "Main.classPK"
        $sa_3 = "plugins/Server.classPK"
        $sa_4 = "IDPK"

        $sb_1 = "config.iniPK"
        $sb_2 = "password.iniPK"
        $sb_3 = "plugins/Server.classPK"
        $sb_4 = "LoadStub.classPK"
        $sb_5 = "LoadStubDecrypted.classPK"
        $sb_7 = "LoadPassword.classPK"
        $sb_8 = "DecryptStub.classPK"
        $sb_9 = "ClassLoaders.classPK"

        $sc_1 = "config.xml"
        $sc_2 = "options"
        $sc_3 = "plugins"
        /* $sc_4 = "util" */
        $sc_5 = "util/OSHelper"
        $sc_6 = "Start.class"
        $sc_7 = "AlienSpy"
        /* $sc_8 = "PK" */ /* too short atom - disabled for performance reasons */

Detection condition:
uint16(0) == 0x4B50 and filesize < 800KB and ( (all of ($sa_*)) or (all of ($sb_*)) or (all of ($sc_*)) )

Full rule:
rule crime_win_rat_AlienSpy
{
meta:
	description = "Alien Spy Remote Access Trojan"
	author = "General Dynamics Fidelis Cybersecurity Solutions - Threat Research Team"
	reference_1 = "www.fidelissecurity.com/sites/default/files/FTA_1015_Alienspy_FINAL.pdf"
	reference_2 = "www.fidelissecurity.com/sites/default/files/AlienSpy-Configs2_1_2.csv"
	date = "04-Apr-15"
	filetype = "Java"
	hash_1 = "075fa0567d3415fbab3514b8aa64cfcb"
	hash_2 = "818afea3040a887f191ee9d0579ac6ed"
	hash_3 = "973de705f2f01e82c00db92eaa27912c"
	hash_4 = "7f838907f9cc8305544bd0ad4cfd278e"
	hash_5 = "071e[PII_REDACTED]d47a12a8c4b3adfea"
	hash_6 = "a7d50760d49faff3656903c1130fd20b"
	hash_7 = "f399afb901fcdf436a1b2a135da3ee39"
	hash_8 = "3698a3630f80a632c0c7c12e929184fb"
	hash_9 = "fdb674cadfa038ff9d931e376f89f1b6"

	id = "a79789cd-9b16-58f5-ab51-48bb900583d1"
   strings:

        $sa_1 = "META-INF/MANIFEST.MF"
        $sa_2 = "Main.classPK"
        $sa_3 = "plugins/Server.classPK"
        $sa_4 = "IDPK"

        $sb_1 = "config.iniPK"
        $sb_2 = "password.iniPK"
        $sb_3 = "plugins/Server.classPK"
        $sb_4 = "LoadStub.classPK"
        $sb_5 = "LoadStubDecrypted.classPK"
        $sb_7 = "LoadPassword.classPK"
        $sb_8 = "DecryptStub.classPK"
        $sb_9 = "ClassLoaders.classPK"

        $sc_1 = "config.xml"
        $sc_2 = "options"
        $sc_3 = "plugins"
        /* $sc_4 = "util" */
        $sc_5 = "util/OSHelper"
        $sc_6 = "Start.class"
        $sc_7 = "AlienSpy"
        /* $sc_8 = "PK" */ /* too short atom - disabled for performance reasons */

  condition:

	uint16(0) == 0x4B50 and filesize < 800KB and ( (all of ($sa_*)) or (all of ($sb_*)) or (all of ($sc_*)) )
}
YARA Detection Rule: Indetectables_RAT
Repository: Neo23x0/signature-base
Detects: Detects Indetectables RAT based on strings found in research by Paul Rascagneres & Ronan Mouchoux
Author: Florian Roth (Nextron Systems)
Reference: http://www.sekoia.fr/blog/when-a-brazilian-string-smells-bad/

Pattern signatures:
$s1 = "Coded By M3" fullword wide
		$s2 = "Stub Undetector M3" fullword wide
		$s3 = "www.webmenegatti.com.br" wide
		$s4 = "M3n3gatt1" fullword wide
		$s5 = "TheMisterFUD" fullword wide
		$s6 = "KillZoneKillZoneKill" fullword ascii
		$s7 = "[[__M3_F_U_D_M3__]]$" fullword ascii
		$s8 = "M3_F_U_D_M3" ascii
		$s9 = "M3n3gatt1hack3r" fullword wide
		$s10 = "M3n3gatt1hack3r" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 5000KB and 1 of them

Full rule:
rule Indetectables_RAT {
	meta:
		description = "Detects Indetectables RAT based on strings found in research by Paul Rascagneres & Ronan Mouchoux"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.sekoia.fr/blog/when-a-brazilian-string-smells-bad/"
		date = "2015-10-01"
		super_rule = 1
		hash1 = "081905074c19d5e32fd41a24b4c512d8fd9d2c3a8b7382009e3ab920728c7105"
		hash2 = "66306c2a55a3c17b350afaba76db7e91bfc835c0e90a42aa4cf59e4179b80229"
		hash3 = "1fa810018f6dd169e46a62a4f77ae076f93a853bfc33c7cf[PII_REDACTED]5f6801"
		id = "f8322822-617c-50cf-8b64-60da3a202ca5"
	strings:
		$s1 = "Coded By M3" fullword wide
		$s2 = "Stub Undetector M3" fullword wide
		$s3 = "www.webmenegatti.com.br" wide
		$s4 = "M3n3gatt1" fullword wide
		$s5 = "TheMisterFUD" fullword wide
		$s6 = "KillZoneKillZoneKill" fullword ascii
		$s7 = "[[__M3_F_U_D_M3__]]$" fullword ascii
		$s8 = "M3_F_U_D_M3" ascii
		$s9 = "M3n3gatt1hack3r" fullword wide
		$s10 = "M3n3gatt1hack3r" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 5000KB and 1 of them
}
YARA Detection Rule: BergSilva_Malware
Repository: Neo23x0/signature-base
Detects: Detects a malware from the same author as the Indetectables RAT
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$x1 = "C:\\Users\\Berg Silva\\Desktop\\" wide
		$x2 = "URLDownloadToFileA 0, \"https://dl.dropbox.com/u/105015858/nome.exe\", \"c:\\nome.exe\", 0, 0" fullword wide

		$s1 = " Process.Start (Path.GetTempPath() & \"name\" & \".exe\") 'start server baixado" fullword wide
		$s2 = "FileDelete(@TempDir & \"\\nome.exe\") ;Deleta o Arquivo para que possa ser executado normalmente" fullword wide
		$s3 = " Lib \"\\WINDOWS\\system32\\UsEr32.dLl\"" fullword wide
		$s4 = "$Directory = @TempDir & \"\\nome.exe\" ;Define a variavel" fullword wide
		$s5 = "https://dl.dropbox.com/u/105015858" wide

Detection condition:
uint16(0) == 0x5a4d and ( 1 of ($x*) or 2 of ($s*) )

Full rule:
rule BergSilva_Malware {
	meta:
		description = "Detects a malware from the same author as the Indetectables RAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015-10-01"
		super_rule = 1
		hash1 = "00e175cbad629ee118d01c49c11f3d8b8840350d2dd6d16bd81e47ae926f641e"
		hash2 = "6b4cbbee296e4a0e867302f783d25d276b888b1bf1dcab9170e205d276c22cfc"
		id = "5f35aea6-1d80-594a-a6e0-8e8bb30bc358"
	strings:
		$x1 = "C:\\Users\\Berg Silva\\Desktop\\" wide
		$x2 = "URLDownloadToFileA 0, \"https://dl.dropbox.com/u/105015858/nome.exe\", \"c:\\nome.exe\", 0, 0" fullword wide

		$s1 = " Process.Start (Path.GetTempPath() & \"name\" & \".exe\") 'start server baixado" fullword wide
		$s2 = "FileDelete(@TempDir & \"\\nome.exe\") ;Deleta o Arquivo para que possa ser executado normalmente" fullword wide
		$s3 = " Lib \"\\WINDOWS\\system32\\UsEr32.dLl\"" fullword wide
		$s4 = "$Directory = @TempDir & \"\\nome.exe\" ;Define a variavel" fullword wide
		$s5 = "https://dl.dropbox.com/u/105015858" wide
	condition:
		uint16(0) == 0x5a4d and ( 1 of ($x*) or 2 of ($s*) )
}
YARA Detection Rule: HKTL_PowerSploit
Repository: Neo23x0/signature-base
Detects: Detects default strings used by PowerSploit to establish persistence
Author: Markus Neis
Reference: https://www.hybrid-analysis.com/sample/16937e76db6d88ed0420ee87317424af2d4e19117fe12d1364fee35aa2fadb75?environmentId=100

Pattern signatures:
$ps = "function" nocase ascii wide
      $s1 = "/Create /RU system /SC ONLOGON" ascii wide
      $s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide

Detection condition:
all of them

Full rule:
rule HKTL_PowerSploit {
   meta:
      description = "Detects default strings used by PowerSploit to establish persistence"
      author = "Markus Neis"
      reference = "https://www.hybrid-analysis.com/sample/16937e76db6d88ed0420ee87317424af2d4e19117fe12d1364fee35aa2fadb75?environmentId=100" /*MuddyWater*/
      date = "2018-06-23"
      hash1 = "16937e76db6d88ed0420ee87317424af2d4e19117fe12d1364fee35aa2fadb75"
      id = "8cb0753c-c5bb-56fc-b492-4e785f4bdaf4"
   strings:
      $ps = "function" nocase ascii wide
      $s1 = "/Create /RU system /SC ONLOGON" ascii wide
      $s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide
   condition:
      all of them
}
YARA Detection Rule: HvS_APT37_smb_scanner
Repository: Neo23x0/signature-base
Detects: Unknown smb login scanner used by APT37
Author: Marc Stroebel

Pattern signatures:
$s1 = "Scan.exe StartIP EndIP ThreadCount logfilePath [Username Password Deep]" fullword ascii
      $s2 = "%s - %s:(Username - %s / Password - %s" fullword ascii
      $s3 = "Load mpr.dll Error " fullword ascii
      $s4 = "Load Netapi32.dll Error " fullword ascii
      $s5 = "%s U/P not Correct! - %d" fullword ascii
      $s6 = "GetNetWorkInfo Version 1.0" fullword wide
      $s7 = "Hello World!" fullword wide
      $s8 = "%s Error: %ld" fullword ascii
      $s9 = "%s U/P Correct!" fullword ascii
      $s10 = "%s --------" fullword ascii
      $s11 = "%s%-30s%I64d" fullword ascii
      $s12 = "%s%-30s(DIR)" fullword ascii
      $s13 = "%04d-%02d-%02d %02d:%02d" fullword ascii
      $s14 = "Share:              Local Path:                   Uses:   Descriptor:" fullword ascii
      $s15 = "Share:              Type:                   Remark:" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and (10 of them)

Full rule:
rule HvS_APT37_smb_scanner {
   meta:
      description = "Unknown smb login scanner used by APT37"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Marc Stroebel"
      date = "2020-12-15"
      reference1 = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
      reference2 = "https://www.hybrid-analysis.com/sample/d[PII_REDACTED]508d6961f061aaffe3ae5321bd64d8ceb6b2788f[PII_REDACTED]fc?environmentId=2"
      id = "89a5cc32-f151-583d-823d-692de2c2b084"
   strings:
      $s1 = "Scan.exe StartIP EndIP ThreadCount logfilePath [Username Password Deep]" fullword ascii
      $s2 = "%s - %s:(Username - %s / Password - %s" fullword ascii
      $s3 = "Load mpr.dll Error " fullword ascii
      $s4 = "Load Netapi32.dll Error " fullword ascii
      $s5 = "%s U/P not Correct! - %d" fullword ascii
      $s6 = "GetNetWorkInfo Version 1.0" fullword wide
      $s7 = "Hello World!" fullword wide
      $s8 = "%s Error: %ld" fullword ascii
      $s9 = "%s U/P Correct!" fullword ascii
      $s10 = "%s --------" fullword ascii
      $s11 = "%s%-30s%I64d" fullword ascii
      $s12 = "%s%-30s(DIR)" fullword ascii
      $s13 = "%04d-%02d-%02d %02d:%02d" fullword ascii
      $s14 = "Share:              Local Path:                   Uses:   Descriptor:" fullword ascii
      $s15 = "Share:              Type:                   Remark:" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and (10 of them)
}
YARA Detection Rule: HvS_APT37_cred_tool
Repository: Neo23x0/signature-base
Detects: Unknown cred tool used by APT37
Author: Markus Poelloth
Reference: https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf

Pattern signatures:
$s1 = "        <requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"></requestedExecutionLevel>" fullword ascii
      $s2 = "Domain Login" fullword ascii
      $s3 = "IEShims_GetOriginatingThreadContext" fullword ascii
      $s4 = " Type Descriptor'" fullword ascii
      $s5 = "User: %s" fullword ascii
      $s6 = "Pass: %s" fullword ascii
      $s7 = "  <trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\">" fullword ascii
      $s8 = "E@c:\\u" fullword ascii

Detection condition:
filesize < 500KB and 7 of them

Full rule:
rule HvS_APT37_cred_tool {
   meta:
      description = "Unknown cred tool used by APT37"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Markus Poelloth"
      date = "2020-12-15"
      reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
      id = "e830025a-f2ac-55b1-aca3-ded9dba83a67"
   strings:
      $s1 = "        <requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"></requestedExecutionLevel>" fullword ascii
      $s2 = "Domain Login" fullword ascii
      $s3 = "IEShims_GetOriginatingThreadContext" fullword ascii
      $s4 = " Type Descriptor'" fullword ascii
      $s5 = "User: %s" fullword ascii
      $s6 = "Pass: %s" fullword ascii
      $s7 = "  <trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\">" fullword ascii
      $s8 = "E@c:\\u" fullword ascii
   condition:
      filesize < 500KB and 7 of them
}