deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: MAL_LNX_LinaDoor_Rootkit_May22
Repository: Neo23x0/signature-base
Detects: Detects LinaDoor Linux Rootkit
Author: Florian Roth
Reference: Internal Research

Pattern signatures:
$s1 = "/dev/net/.../rootkit_/" ascii
      $s2 = "did_exec" ascii fullword
      $s3 = "rh_reserved_tp_target" ascii fullword
      $s4 = "HIDDEN_SERVICES" ascii fullword
      $s5 = "bypass_udp_ports" ascii fullword
      $s6 = "DoBypassIP" ascii fullword

      $op1 = { 74 2a 4c 89 ef e8 00 00 00 00 48 89 da 4c 29 e2 48 01 c2 31 c0 4c 39 f2 }
      $op2 = { e8 00 00 00 00 48 89 da 4c 29 e2 48 01 c2 31 c0 4c 39 f2 48 0f 46 c3 5b }
      $op3 = { 48 89 c3 74 2a 4c 89 ef e8 00 00 00 00 48 89 da 4c 29 e2 48 01 c2 31 c0 }
      $op4 = { 4c 29 e2 48 01 c2 31 c0 4c 39 f2 48 0f 46 c3 5b 41 5c 41 5d }

      $fp1 = "/wgsyncdaemon.pid"

Detection condition:
uint16(0) == 0x457f and
      filesize < 2000KB and 2 of them 
      and not 1 of ($fp*)
      or 4 of them

Full rule:
rule MAL_LNX_LinaDoor_Rootkit_May22 {
   meta:
      description = "Detects LinaDoor Linux Rootkit"
      author = "Florian Roth"
      reference = "Internal Research"
      date = "2022-05-19"
      modified = "2023-05-16"
      score = 85
      hash1 = "25ff1efe36eb15f8e[PII_REDACTED]d4c9ec30b42dca072b1bf22f041a04049cd9"
      hash2 = "4792e22d4c9996af1cb58ed54fee921a7a9fdd19f7a5e7f268b6793cdd1ab4e7"
      hash3 = "9067230a0be61347c0cf5c676580fc4f7c8580fc87c932078ad0c3f425300fb7"
      hash4 = "940b79dc25d1988dabd643e879d18e5e47e25d0bb61c1f382f9c7a6c545bfcff"
      hash5 = "a1df5b7e4181c8c1c39de976bbf6601a91cde23134deda25703bc6d9cb499044"
      hash6 = "c4eea99658cd82d48aaddaec4781ce0c893de42b33376b6c60a949008a3efb27"
      hash7 = "c5651add0c7db3bbfe0bbffe4eafe9cd5aa254d99be7e3404a2054d6e07d20e7"
      id = "e2f250b4-9a8a-5d70-83d7-5d12ad3763fb"
   strings:
      $s1 = "/dev/net/.../rootkit_/" ascii
      $s2 = "did_exec" ascii fullword
      $s3 = "rh_reserved_tp_target" ascii fullword
      $s4 = "HIDDEN_SERVICES" ascii fullword
      $s5 = "bypass_udp_ports" ascii fullword
      $s6 = "DoBypassIP" ascii fullword

      $op1 = { 74 2a 4c 89 ef e8 00 00 00 00 48 89 da 4c 29 e2 48 01 c2 31 c0 4c 39 f2 }
      $op2 = { e8 00 00 00 00 48 89 da 4c 29 e2 48 01 c2 31 c0 4c 39 f2 48 0f 46 c3 5b }
      $op3 = { 48 89 c3 74 2a 4c 89 ef e8 00 00 00 00 48 89 da 4c 29 e2 48 01 c2 31 c0 }
      $op4 = { 4c 29 e2 48 01 c2 31 c0 4c 39 f2 48 0f 46 c3 5b 41 5c 41 5d }

      $fp1 = "/wgsyncdaemon.pid"
   condition:
      uint16(0) == 0x457f and
      filesize < 2000KB and 2 of them 
      and not 1 of ($fp*)
      or 4 of them
}
YARA Detection Rule: APT_MAL_DNS_Hijacking_Campaign_AA19_024A
Repository: Neo23x0/signature-base
Detects: Detects malware used in DNS Hijackign campaign
Author: Florian Roth (Nextron Systems)
Reference: https://www.us-cert.gov/ncas/alerts/AA19-024A

Pattern signatures:
$s2 = "/Client/Login?id=" fullword ascii
      $s3 = "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko" fullword ascii
      $s4 = ".\\Configure.txt" fullword ascii
      $s5 = "Content-Disposition: form-data; name=\"files\"; filename=\"" fullword ascii
      $s6 = "Content-Disposition: form-data; name=\"txts\"" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them

Full rule:
rule APT_MAL_DNS_Hijacking_Campaign_AA19_024A {
   meta:
      description = "Detects malware used in DNS Hijackign campaign"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.us-cert.gov/ncas/alerts/AA19-024A"
      date = "2019-01-25"
      hash1 = "2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec"
      hash2 = "45a9edb24d4174592c69d9d37a534a518fbe2a88d3817fc0cc739e455883b8ff"
      id = "6a476052-ba4e-5049-9c7a-f8949d26e7b5"
   strings:
      $s2 = "/Client/Login?id=" fullword ascii
      $s3 = "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko" fullword ascii
      $s4 = ".\\Configure.txt" fullword ascii
      $s5 = "Content-Disposition: form-data; name=\"files\"; filename=\"" fullword ascii
      $s6 = "Content-Disposition: form-data; name=\"txts\"" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them
}
YARA Detection Rule: SUSP_Scheduled_Task_Java_JAR_Aug25
Repository: Neo23x0/signature-base
Detects: Detects scheduled tasks that execute Java JAR files, which is suspicious but not necessarily malicious
Author: Florian Roth
Reference: Internal Research

Pattern signatures:
$a0 = "<Task version=" wide
      $a1 = "xmlns=\"http://schemas.microsoft.com/windows/" wide

      $sa1 = "java.exe</Command>" wide
      $sa2 = "javaw.exe</Command>" wide

      $sb1 = "<Arguments>-jar " wide

Detection condition:
uint16(0) == 0xfeff
      and filesize < 500KB
      and all of ($a*)
      and 1 of ($sa*)
      and 1 of ($sb*)

Full rule:
rule SUSP_Scheduled_Task_Java_JAR_Aug25 {
   meta:
      description = "Detects scheduled tasks that execute Java JAR files, which is suspicious but not necessarily malicious"
      author = "Florian Roth"
      date = "2025-08-07"
      score = 60
      reference = "Internal Research"
      hash = "7c5999082d9c5f3dd342ca05191311ddd1e24ba7675d1e9763fb4d962be3a933"
   strings:
      $a0 = "<Task version=" wide
      $a1 = "xmlns=\"http://schemas.microsoft.com/windows/" wide

      $sa1 = "java.exe</Command>" wide
      $sa2 = "javaw.exe</Command>" wide

      $sb1 = "<Arguments>-jar " wide
   condition:
      uint16(0) == 0xfeff
      and filesize < 500KB
      and all of ($a*)
      and 1 of ($sa*)
      and 1 of ($sb*)
}
YARA Detection Rule: SUSP_JAVA_Loader_Indicators_Aug25
Repository: Neo23x0/signature-base
Detects: Detects indicators of a Java loader used in phishing campaigns
Author: Florian Roth
Reference: https://www.malwation.com/blog/technical-analysis-of-a-stealth-java-loader-used-in-phishing-campaigns-targeting-turkiye

Pattern signatures:
$s1 = "Loader.classPK" ascii fullword
      $s2 = "stubPK" ascii
      $s3 = "META-INF/MANIFEST.MFPK" ascii

Detection condition:
uint16(0) == 0x4b50
      and filesize < 500KB
      and $s1 in (filesize - 224..filesize)
      and $s2 in (filesize - 224..filesize)
      and $s3 in (filesize - 224..filesize)

Full rule:
rule SUSP_JAVA_Loader_Indicators_Aug25 {
   meta:
      description = "Detects indicators of a Java loader used in phishing campaigns"
      author = "Florian Roth"
      reference = "https://www.malwation.com/blog/technical-analysis-of-a-stealth-java-loader-used-in-phishing-campaigns-targeting-turkiye"
      date = "2025-08-07"
      score = 70
      hash1 = "c4cf746fce283878dde567e5457a8ebdbb7ff3414be46569ecdd57338bd96fa1"
   strings:
      $s1 = "Loader.classPK" ascii fullword
      $s2 = "stubPK" ascii
      $s3 = "META-INF/MANIFEST.MFPK" ascii
   condition:
      uint16(0) == 0x4b50
      and filesize < 500KB
      and $s1 in (filesize - 224..filesize)
      and $s2 in (filesize - 224..filesize)
      and $s3 in (filesize - 224..filesize)
}
YARA Detection Rule: MAL_JAVA_Loader_Final_Jar_Aug25
Repository: Neo23x0/signature-base
Detects: Detects a final Java loader JAR file used in phishing campaigns
Author: Florian Roth
Reference: https://www.malwation.com/blog/technical-analysis-of-a-stealth-java-loader-used-in-phishing-campaigns-targeting-turkiye

Pattern signatures:
$s1 = "Obfuscation by Allatori Obfuscator" ascii fullword
      $s2 = "MANIFEST.MFM" ascii fullword
      $s3 = "GetCpu.classPK" ascii fullword
      $s4 = "extra/spreader" ascii fullword

Detection condition:
all of them

Full rule:
rule MAL_JAVA_Loader_Final_Jar_Aug25 {
   meta:
      description = "Detects a final Java loader JAR file used in phishing campaigns"
      author = "Florian Roth"
      reference = "https://www.malwation.com/blog/technical-analysis-of-a-stealth-java-loader-used-in-phishing-campaigns-targeting-turkiye"
      date = "2025-08-07"
      score = 85
      hash1 = "0a7fddd91b332c8daee2c0727b884fc92cfaede02883dbad75f7efc299e884e3"
   strings:
      $s1 = "Obfuscation by Allatori Obfuscator" ascii fullword
      $s2 = "MANIFEST.MFM" ascii fullword
      $s3 = "GetCpu.classPK" ascii fullword
      $s4 = "extra/spreader" ascii fullword
   condition:
      all of them
}
YARA Detection Rule: SUSP_JAVA_Class_Allatori_Obfuscator_Aug25
Repository: Neo23x0/signature-base
Detects: Detects a relatively small Java class file obfuscated by Allatori Obfuscator
Author: Florian Roth
Reference: https://www.malwation.com/blog/technical-analysis-of-a-stealth-java-loader-used-in-phishing-campaigns-targeting-turkiye

Pattern signatures:
$x1 = "Obfuscation by Allatori Obfuscator" ascii fullword

Detection condition:
uint16(0) == 0x4b50
      and filesize < 500KB
      and $x1

Full rule:
rule SUSP_JAVA_Class_Allatori_Obfuscator_Aug25 {
   meta:
      description = "Detects a relatively small Java class file obfuscated by Allatori Obfuscator"
      author = "Florian Roth"
      reference = "https://www.malwation.com/blog/technical-analysis-of-a-stealth-java-loader-used-in-phishing-campaigns-targeting-turkiye"
      date = "2025-08-07"
      score = 50
      hash1 = "0a7fddd91b332c8daee2c0727b884fc92cfaede02883dbad75f7efc299e884e3"
   strings:
      $x1 = "Obfuscation by Allatori Obfuscator" ascii fullword
   condition:
      uint16(0) == 0x4b50
      and filesize < 500KB
      and $x1
}
YARA Detection Rule: VULN_Erlang_OTP_SSH_CVE_2025_32433_Apr25
Repository: Neo23x0/signature-base
Detects: Detects binaries vulnerable to CVE-2025-32433 in Erlang/OTP SSH
Author: Pierre-Henri Pezier, Florian Roth
Reference: https://www.upwind.io/feed/cve-2025-32433-critical-erlang-otp-ssh-vulnerability-cvss-10

Pattern signatures:
$a1 = { 46 4F 52 31 ?? ?? ?? ?? 42 45 41 4D }

      $s1 = "ssh_connection.erl"

      $fix1 = "chars_limit"
      $fix2 = "allow    macro_log"
      $fix3 = "logger"
      $fix4 = "max_log_item_len"

Detection condition:
filesize < 1MB
      and $a1 at 0 // BEAM file header
      and $s1
      and not 1 of ($fix*)

Full rule:
rule VULN_Erlang_OTP_SSH_CVE_2025_32433_Apr25 {
   meta:
      description = "Detects binaries vulnerable to CVE-2025-32433 in Erlang/OTP SSH"
      author = "Pierre-Henri Pezier, Florian Roth"
      reference = "https://www.upwind.io/feed/cve-2025-32433-critical-erlang-otp-ssh-vulnerability-cvss-10"
      date = "2025-04-18"
      score = 60
   strings:
      $a1 = { 46 4F 52 31 ?? ?? ?? ?? 42 45 41 4D }

      $s1 = "ssh_connection.erl"

      $fix1 = "chars_limit"
      $fix2 = "allow    macro_log"
      $fix3 = "logger"
      $fix4 = "max_log_item_len"
   condition:
      filesize < 1MB
      and $a1 at 0 // BEAM file header
      and $s1
      and not 1 of ($fix*)
}
YARA Detection Rule: glassRAT
Repository: Neo23x0/signature-base
Detects: Detects GlassRAT by RSA (modified by Florian Roth - speed improvements)
Author: RSA RESEARCH

Pattern signatures:
$bin1 = {85 C0 B3 01} 		/* 	test    eax, eax
										  mov     bl, 1 */
		// $bin2 = {34 02}				// xor     al, 2 ---> XOR key for rundll32.exe
		$bin3 = {68 4C 50 00 10}	// push    offset KeyName  ; "2"
		$bin4 = {68 48 50 00 10}	// push    offset a3       ; "3"
		$bin5 = {68 44 50 00 10}	// push    offset a4       ; "4"
		$hs = {CB FF 5D C9 AD 3F 5B A1 54 13 FE FB 05 C6 22}  // Initial Handshake ---> can be added or removed for hunting for different variants
		//$re1  = {50 00 00 00}
		//$re2  = {BB 01 00 00}
		// Dwords of C2 Ports (80 | 443 | 53) 2 -3 times
		$s1 = "pwlfnn10,gzg" // rundll32.exe XOR 02
		$s2 = "AddNum"
		$s3 = "ServiceMain"
		$s4 = "The Window"
		$s5 = "off.dat"

Detection condition:
all of ($bin*) and $hs and 3 of ($s*) //The conditions can be adjusted for hunting for different variants

Full rule:
rule glassRAT
{
	meta:
		author = "RSA RESEARCH"
		date = "3 Nov 2015"
      description = "Detects GlassRAT by RSA (modified by Florian Roth - speed improvements)"
		Info = "GlassRat"
		/* MD5s
			37adc72339a0c2c755e7fef346906330
			59b404076e1af7d0faae4a62fa41b69f
			5c17395731ec666ad0056d3c88e99c4d
			e98027f502f5acbcb5eda17e67a21cdc
			87a965cf75b2da112aea737220f2b5c2
			22e01495b4419b564d5254d2122068d9
			42b57c0c4977a890ecb0ea[PII_REDACTED]
			b7f2020208ebd137616dadb60700b847	*/
		id = "7739d1f6-f16d-5599-9388-a1d89dbeb355"
	strings:
		$bin1 = {85 C0 B3 01} 		/* 	test    eax, eax
										  mov     bl, 1 */
		// $bin2 = {34 02}				// xor     al, 2 ---> XOR key for rundll32.exe
		$bin3 = {68 4C 50 00 10}	// push    offset KeyName  ; "2"
		$bin4 = {68 48 50 00 10}	// push    offset a3       ; "3"
		$bin5 = {68 44 50 00 10}	// push    offset a4       ; "4"
		$hs = {CB FF 5D C9 AD 3F 5B A1 54 13 FE FB 05 C6 22}  // Initial Handshake ---> can be added or removed for hunting for different variants
		//$re1  = {50 00 00 00}
		//$re2  = {BB 01 00 00}
		// Dwords of C2 Ports (80 | 443 | 53) 2 -3 times
		$s1 = "pwlfnn10,gzg" // rundll32.exe XOR 02
		$s2 = "AddNum"
		$s3 = "ServiceMain"
		$s4 = "The Window"
		$s5 = "off.dat"
	condition:
		all of ($bin*) and $hs and 3 of ($s*) //The conditions can be adjusted for hunting for different variants
}
YARA Detection Rule: GlassRAT_Generic
Repository: Neo23x0/signature-base
Detects: Detects GlassRAT Malware
Author: Florian Roth (Nextron Systems)
Reference: https://blogs.rsa.com/peering-into-glassrat/

Pattern signatures:
$s1 = "cmd.exe /c %s" fullword ascii
		$s2 = "update.dll" fullword ascii
		$s3 = "SYSTEM\\CurrentControlSet\\Services\\RasAuto\\Parameters" fullword ascii
		$s4 = "%%temp%%\\%u" fullword ascii
		$s5 = "\\off.dat" ascii
		$s6 = "rundll32 \"%s\",AddNum" fullword ascii
		$s7 = "cmd.exe /c erase /F \"%s\"" fullword ascii
		$s8 = "SYSTEM\\ControlSet00%d\\Services\\RasAuto" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 15MB and 5 of them

Full rule:
rule GlassRAT_Generic {
	meta:
		description = "Detects GlassRAT Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blogs.rsa.com/peering-into-glassrat/"
		date = "2015-11-23"
		score = 80
		hash1 = "30d26aebcee21e4811ff3a44a7198a5c519843a24f334880384a7158e07ae399"
		hash2 = "3bdeb3805e9230361fb93c6ffb0bfec8d3aee9455d95b2428c7f6292d387d3a4"
		hash3 = "79993f[PII_REDACTED]c4d98503e00dc526eb1d0ca4d020d17b010efa6c515ca92e"
		hash4 = "a9b30b928ebf9cda5136ee37053fa045f3a53d0706dcb2343c91013193de761e"
		hash5 = "c11faf7290299bb13925e46d040ed59ab3ca8938eab1f171aa[PII_REDACTED]55cb"
		hash6 = "d95fa58a81ab2d90a8cbe05165c00f9c8ad5b4f49e98df2ad391f[PII_REDACTED]d"
		hash7 = "f1209eb95ce1319af61f371c7f27bf6846eb90f8fd19e8d84110ebaf4744b6ea"
		id = "d09c4a9f-15ad-56d7-b015-94f494420e98"
	strings:
		$s1 = "cmd.exe /c %s" fullword ascii
		$s2 = "update.dll" fullword ascii
		$s3 = "SYSTEM\\CurrentControlSet\\Services\\RasAuto\\Parameters" fullword ascii
		$s4 = "%%temp%%\\%u" fullword ascii
		$s5 = "\\off.dat" ascii
		$s6 = "rundll32 \"%s\",AddNum" fullword ascii
		$s7 = "cmd.exe /c erase /F \"%s\"" fullword ascii
		$s8 = "SYSTEM\\ControlSet00%d\\Services\\RasAuto" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 15MB and 5 of them
}
YARA Detection Rule: SUSP_WER_Critical_HeapCorruption
Repository: Neo23x0/signature-base
Detects: Detects a crashed application that crashed due to a heap corruption error (could be a sign of exploitation)
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/cyb3rops/status/[PII_REDACTED]10092288

Pattern signatures:
$a1 = "ReportIdentifier=" wide
      $a2 = ".Name=Fault Module Name" wide

      $s1 = "c0000374" wide /* Heap Corruption */

Detection condition:
( uint32be(0) == 0x56006500 or uint32be(0) == 0xfffe5600 )
      and all of them

Full rule:
rule SUSP_WER_Critical_HeapCorruption {
   meta:
      description = "Detects a crashed application that crashed due to a heap corruption error (could be a sign of exploitation)"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/cyb3rops/status/[PII_REDACTED]10092288"
      date = "2019-10-18"
      score = 45
      id = "2b1dad5f-cc2c-5d8c-8275-ebb56d079895"
   strings:
      $a1 = "ReportIdentifier=" wide
      $a2 = ".Name=Fault Module Name" wide

      $s1 = "c0000374" wide /* Heap Corruption */
   condition:
      ( uint32be(0) == 0x56006500 or uint32be(0) == 0xfffe5600 )
      and all of them
}
YARA Detection Rule: SUSP_WER_Suspicious_Crash_Directory
Repository: Neo23x0/signature-base
Detects: Detects a crashed application executed in a suspicious directory
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/cyb3rops/status/[PII_REDACTED]59976705

Pattern signatures:
$a1 = "ReportIdentifier=" wide
      $a2 = ".Name=Fault Module Name" wide
      $a3 = "AppPath=" wide nocase

      /* Whitelist */
      $l1 = "AppPath=C:\\Windows\\" wide nocase
      $l2 = "AppPath=C:\\Program" wide nocase
      $l3 = "AppPath=C:\\Python" wide nocase
      $l4 = "AppPath=C:\\Users\\" wide nocase

      /* Blacklist */
      /* covered via Whitelist
      $s1 = "AppPath=C:\\$Recycle.Bin\\" wide
      $s2 = "AppPath=C:\\Perflogs\\" wide
      $s3 = "AppPath=C:\\Temp\\" wide
      $s4 = "AppPath=\\\\" wide // network share, or \\tsclient\c etc.
      $s5 = /AppPath=[C-Z]:\\\\[^\\]{1,64}\.exe/ wide nocase // in the root of a partition - no sub folder
      */
      $s6 = "AppPath=C:\\Users\\Public\\" nocase wide
      $s7 = "AppPath=C:\\Users\\Default\\" nocase wide
      /* Root of AppData */
      $s8 = /AppPath=C:\\Users\\[^\\]{1,64}\\AppData\\(Local|Roaming)\\[^\\]{1,64}\.exe/ wide nocase

Detection condition:
( uint32be(0) == 0x56006500 or uint32be(0) == 0xfffe5600 )
      and all of ($a*) and ( not 1 of ($l*) or 1 of ($s*) )

Full rule:
rule SUSP_WER_Suspicious_Crash_Directory {
   meta:
      description = "Detects a crashed application executed in a suspicious directory"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/cyb3rops/status/[PII_REDACTED]59976705"
      date = "2019-10-18"
      score = 45
      id = "bf91e20c-aa35-5b13-86ed-a63e6fb4d1a2"
   strings:
      $a1 = "ReportIdentifier=" wide
      $a2 = ".Name=Fault Module Name" wide
      $a3 = "AppPath=" wide nocase

      /* Whitelist */
      $l1 = "AppPath=C:\\Windows\\" wide nocase
      $l2 = "AppPath=C:\\Program" wide nocase
      $l3 = "AppPath=C:\\Python" wide nocase
      $l4 = "AppPath=C:\\Users\\" wide nocase

      /* Blacklist */
      /* covered via Whitelist
      $s1 = "AppPath=C:\\$Recycle.Bin\\" wide
      $s2 = "AppPath=C:\\Perflogs\\" wide
      $s3 = "AppPath=C:\\Temp\\" wide
      $s4 = "AppPath=\\\\" wide // network share, or \\tsclient\c etc.
      $s5 = /AppPath=[C-Z]:\\\\[^\\]{1,64}\.exe/ wide nocase // in the root of a partition - no sub folder
      */
      $s6 = "AppPath=C:\\Users\\Public\\" nocase wide
      $s7 = "AppPath=C:\\Users\\Default\\" nocase wide
      /* Root of AppData */
      $s8 = /AppPath=C:\\Users\\[^\\]{1,64}\\AppData\\(Local|Roaming)\\[^\\]{1,64}\.exe/ wide nocase
   condition:
      ( uint32be(0) == 0x56006500 or uint32be(0) == 0xfffe5600 )
      and all of ($a*) and ( not 1 of ($l*) or 1 of ($s*) )
}
YARA Detection Rule: APT30_Generic_H
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "\\Temp1020.txt" ascii
		$s1 = "Xmd.Txe" fullword ascii
		$s2 = "\\Internet Exp1orer" ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Generic_H {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash1 = "2a4c8752f3e7fde0139421b8d5713b29c720685d"
		hash2 = "4350e906d590dca5fcc90ed[PII_REDACTED]e0a4e3d"
		id = "1908e985-9634-51dc-8972-53afa13c26a3"
	strings:
		$s0 = "\\Temp1020.txt" ascii
		$s1 = "Xmd.Txe" fullword ascii
		$s2 = "\\Internet Exp1orer" ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_2
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "ForZRLnkWordDlg.EXE" fullword wide
		$s1 = "ForZRLnkWordDlg Microsoft " fullword wide
		$s9 = "ForZRLnkWordDlg 1.0 " fullword wide
		$s11 = "ForZRLnkWordDlg" fullword wide
		$s12 = " (C) 2011" fullword wide

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_2 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "0359ffbef6a752ee1a54447b26e272f4a5a35167"
		id = "821a2de9-48c4-58d8-acc4-1e25025ab5cf"
	strings:
		$s0 = "ForZRLnkWordDlg.EXE" fullword wide
		$s1 = "ForZRLnkWordDlg Microsoft " fullword wide
		$s9 = "ForZRLnkWordDlg 1.0 " fullword wide
		$s11 = "ForZRLnkWordDlg" fullword wide
		$s12 = " (C) 2011" fullword wide
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_3
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s5 = "Software\\Mic" ascii
		$s6 = "HHOSTR" ascii
		$s9 = "ThEugh" fullword ascii
		$s10 = "Moziea/" ascii
		$s12 = "%s%s(X-" ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_3 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "d0320144e65c9af0052f8dee0419e8deed91b61b"
		id = "62e81385-26f5-545d-92ff-6604ff4d0186"
	strings:
		$s5 = "Software\\Mic" ascii
		$s6 = "HHOSTR" ascii
		$s9 = "ThEugh" fullword ascii
		$s10 = "Moziea/" ascii
		$s12 = "%s%s(X-" ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Generic_C
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "MYUSER32.dll" fullword ascii
		$s1 = "MYADVAPI32.dll" fullword ascii
		$s2 = "MYWSOCK32.dll" fullword ascii
		$s3 = "MYMSVCRT.dll" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Generic_C {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash1 = "8667f635fe089c5e2c666b3fe22eaf3ff8590a69"
		hash2 = "0c4fcef3b583d0ffffc2b14b9297d3a4"
		hash3 = "37aee58655f5859e60ece6b249107b87"
		hash4 = "4154548e1f8e9e7eb39d48a4cd75bcd1"
		hash5 = "a2e0203e665976a13cdffb[PII_REDACTED]"
		hash6 = "b4ae0004094b37a40978ef06f311a75e"
		hash7 = "e39756bc99ee1b05e5ee92a1cdd5faf4"
		id = "25ec8d54-9875-5bf5-abc9-296f18f3c5e5"
	strings:
		$s0 = "MYUSER32.dll" fullword ascii
		$s1 = "MYADVAPI32.dll" fullword ascii
		$s2 = "MYWSOCK32.dll" fullword ascii
		$s3 = "MYMSVCRT.dll" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}