deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: MAL_Passwordstate_Moserware_Backdoor_Apr21_1
Repository: Neo23x0/signature-base
Detects: Detects backdoor used in Passwordstate incident
Author: Florian Roth (Nextron Systems)
Reference: https://thehackernews.com/2021/04/passwordstate-password-manager-update.html

Pattern signatures:
$x1 = "https://passwordstate-18ed2.kxcdn.com" wide

      $s1 = " ProxyUserName, ProxyPassword FROM [SystemSettings]" wide fullword
      $s2 = "PasswordstateService.Passwordstate.Crypto" wide
      $s3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.128 Safari" wide fullword

      $op1 = { 00 4c 00 4e 00 43 00 4c 00 49 00 31 00 31 00 3b 00 00 17 }
      $op2 = { 4c 00 49 00 31 00 31 00 3b 00 00 17 50 00 72 00 }
      $op3 = { 61 00 74 00 65 00 2d 00 31 00 38 00 65 00 64 00 32 00 2e 00 6b 00 78 00 }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 200KB and
      1 of ($x*) or 3 of them

Full rule:
rule MAL_Passwordstate_Moserware_Backdoor_Apr21_1 {
   meta:
      description = "Detects backdoor used in Passwordstate incident"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://thehackernews.com/2021/04/passwordstate-password-manager-update.html"
      date = "2021-04-25"
      hash1 = "c2169ab4a39220d21709964d57e2eafe4b68c115061cbb64507cfbbddbe635c6"
      hash2 = "f23f9c2aaf94147b2c5d4b39b56514cd67102d3293bdef85101e2c05ee1c3bf9"
      id = "061de3ae-c404-5e4a-a16b-b3b208b1ae7f"
   strings:
      $x1 = "https://passwordstate-18ed2.kxcdn.com" wide

      $s1 = " ProxyUserName, ProxyPassword FROM [SystemSettings]" wide fullword
      $s2 = "PasswordstateService.Passwordstate.Crypto" wide
      $s3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.128 Safari" wide fullword

      $op1 = { 00 4c 00 4e 00 43 00 4c 00 49 00 31 00 31 00 3b 00 00 17 }
      $op2 = { 4c 00 49 00 31 00 31 00 3b 00 00 17 50 00 72 00 }
      $op3 = { 61 00 74 00 65 00 2d 00 31 00 38 00 65 00 64 00 32 00 2e 00 6b 00 78 00 }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 200KB and
      1 of ($x*) or 3 of them
}
YARA Detection Rule: SUSP_GObfuscate_May21
Repository: Neo23x0/signature-base
Detects: Identifies binaries obfuscated with gobfuscate
Author: James Quinn, Paul Hager (merged with new similar pattern)
Reference: https://github.com/unixpickle/gobfuscate

Pattern signatures:
$s1 = { 0F B6 ?? ?? ?? 0F B6 ?? ?? ?? 31 D? [0-1] 88 ?? ?? ?? 48 FF C? 48 83 F? ?? 7C E6 48 }
      // $s1a = { 0f b6 ?? ?? ?? 0f b6 ?? ?? ?? 31 d6 40 88 ?? ?? ?? 48 ff c1 48 83 f9 ?? 7c e6 48 } // new
      // $s1b = { 0f b6 ?? ?? ?? 0f b6 ?? ?? ?? 31 d1    88 ?? ?? ?? 48 ff c0 48 83 f8 ?? 7c e7 48 c7 }
      $s2 = { 0F B6 ?? ?? ?? 31 DA 88 ?? ?? ?? 40 83 ?? ?? 7D 09 0F B6 }

Detection condition:
filesize < 50MB and any of them

Full rule:
rule SUSP_GObfuscate_May21 {
   meta:
      description = "Identifies binaries obfuscated with gobfuscate"
      author = "James Quinn, Paul Hager (merged with new similar pattern)"
      reference = "https://github.com/unixpickle/gobfuscate"
      date = "2021-05-14"
      modified = "2024-04-02"
      score = 70
      id = "ae518296-b1c3-568c-bae0-3e0a6f7600ba"
   strings:
      $s1 = { 0F B6 ?? ?? ?? 0F B6 ?? ?? ?? 31 D? [0-1] 88 ?? ?? ?? 48 FF C? 48 83 F? ?? 7C E6 48 }
      // $s1a = { 0f b6 ?? ?? ?? 0f b6 ?? ?? ?? 31 d6 40 88 ?? ?? ?? 48 ff c1 48 83 f9 ?? 7c e6 48 } // new
      // $s1b = { 0f b6 ?? ?? ?? 0f b6 ?? ?? ?? 31 d1    88 ?? ?? ?? 48 ff c0 48 83 f8 ?? 7c e7 48 c7 }
      $s2 = { 0F B6 ?? ?? ?? 31 DA 88 ?? ?? ?? 40 83 ?? ?? 7D 09 0F B6 }
   condition:
      filesize < 50MB and any of them
}
YARA Detection Rule: HKTL_Reverse_Connect_TCP_PTY_Shell
Repository: Neo23x0/signature-base
Detects: Detects reverse connect TCP PTY shell
Author: Jeff Beley
Reference: https://github.com/infodox/python-pty-shells/blob/master/tcp_pty_backconnect.py

Pattern signatures:
$s1 = "os.dup2(s.fileno(),1)" fullword ascii
      $s2 = "pty.spawn(\"/bin/\")" fullword ascii
      $s3 = "os.putenv(\"HISTFILE\",'/dev/null')" fullword ascii
      $s4 = "socket.socket(socket.AF_INET, socket.SOCK_STREAM)" fullword ascii

Detection condition:
filesize < 1KB and 2 of them

Full rule:
rule HKTL_Reverse_Connect_TCP_PTY_Shell {
   meta:
      description = "Detects reverse connect TCP PTY shell"
      author = "Jeff Beley"
      date = "2019-10-19"
      hash1 = "cae9833292d3013774bdc689d4471fd38e4a80d2d407adf9fa99bc8cde3319bf"
      reference = "https://github.com/infodox/python-pty-shells/blob/master/tcp_pty_backconnect.py"
      id = "a9a90d67-774b-5b32-97c0-d7e06763f2e9"
   strings:
      $s1 = "os.dup2(s.fileno(),1)" fullword ascii
      $s2 = "pty.spawn(\"/bin/\")" fullword ascii
      $s3 = "os.putenv(\"HISTFILE\",'/dev/null')" fullword ascii
      $s4 = "socket.socket(socket.AF_INET, socket.SOCK_STREAM)" fullword ascii
   condition:
      filesize < 1KB and 2 of them
}
YARA Detection Rule: gen_suspicious_InPage_dropper
Repository: Neo23x0/signature-base

Pattern signatures:
$s1 = "InPage Arabic Document"
        $c1 = {31 06 83 c6 04 e2 }
        $c2 = {90 90 90 90 90 90 90 e8 fb }

Detection condition:
filesize < 3MB
        and uint32be(0) == 0xD0CF11E0
        and $s1 
        and 1 of ($c*)

Full rule:
rule gen_suspicious_InPage_dropper
{

    meta:
        hash1 = "013417bd5465d6362cd43c70015c7a74a1b8979785b842b7cfa543cb85985852"
        hash2 = "1d1e7a6175e6c514aaeca8a43dabefa017ddc5b166ccb636789b6a767181a022"
        hash3 = "bd293bdf3be0a44a92bdb21e5fa75c124ad1afed3c869697bf90c9732af0e994"
        hash4 = "d8edf3e69f006f85b9ee4e23704cd5e95e895eb286f9b749021d090448493b6f"
        url1 = "https://cloudblogs.microsoft.com/microsoftsecure/2018/11/08/attack-uses-malicious-inpage-document-and-outdated-vlc-media-player-to-give-attackers-backdoor-access-to-targets/"
        url2 = "https://twitter.com/Ahmedfshosha/status/[PII_REDACTED]21154049"

        id = "9144711a-e6ee-5c97-a5f4-3f6df1d630dc"
    strings:
        $s1 = "InPage Arabic Document"
        $c1 = {31 06 83 c6 04 e2 }
        $c2 = {90 90 90 90 90 90 90 e8 fb }

    condition:
        filesize < 3MB
        and uint32be(0) == 0xD0CF11E0
        and $s1 
        and 1 of ($c*)
}
YARA Detection Rule: APT_RU_APT27_HyperBro_Vftrace_Loader_Jan22_1
Repository: Neo23x0/signature-base
Detects: Yara rule to detect first Hyperbro Loader Stage, often called vftrace.dll. Detects decoding function.
Author: Bundesamt fuer Verfassungsschutz (modified by Florian Roth)
Reference: https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2022-01-bfv-cyber-brief.pdf

Pattern signatures:
$decoder_routine = { 8A ?? 41 10 00 00 8B ?? 28 ?? ?? 4? 3B ?? 72 ?? }

Detection condition:
uint16(0) == 0x5a4d and
        filesize < 5MB and
        $decoder_routine and 
        pe.exports("D_C_Support_SetD_File")

Full rule:
rule APT_RU_APT27_HyperBro_Vftrace_Loader_Jan22_1 {
    meta:
        description = "Yara rule to detect first Hyperbro Loader Stage, often called vftrace.dll. Detects decoding function."
        author = "Bundesamt fuer Verfassungsschutz (modified by Florian Roth)"
        date = "2022-01-14"
        sharing = "TLP:WHITE"
        reference = "https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2022-01-bfv-cyber-brief.pdf"
        hash1 = "333B52C2CFAC56B86EE9D54AEF4F0FF[PII_REDACTED]BC1AA1FE1613EFC2318339A"
        id = "b049e163-2694-5fb9-a3a3-98cc77bcd0ca"
    strings:
        $decoder_routine = { 8A ?? 41 10 00 00 8B ?? 28 ?? ?? 4? 3B ?? 72 ?? }
    condition:
        uint16(0) == 0x5a4d and
        filesize < 5MB and
        $decoder_routine and 
        pe.exports("D_C_Support_SetD_File")
}
YARA Detection Rule: APT_CN_APT27_Compromised_Certficate_Jan22_1
Repository: Neo23x0/signature-base
Detects: Detects compromised certifcates used by APT27 malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2022-01-bfv-cyber-brief.pdf

Detection condition:
for any i in (0 .. pe.number_of_signatures) : (
         pe.signatures[i].issuer contains "DigiCert SHA2 Assured ID Code Signing CA" and
         pe.signatures[i].serial == "08:68:70:51:50:f1:cf:c1:fc:c3:fc:91:a4:49:49:a6"
   )

Full rule:
rule APT_CN_APT27_Compromised_Certficate_Jan22_1 {
   meta:
      description = "Detects compromised certifcates used by APT27 malware"
      author = "Florian Roth (Nextron Systems)"
      date = "2022-01-29"
      score = 80
      reference = "https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2022-01-bfv-cyber-brief.pdf"
      id = "f2f015af-219d-51ab-9529-01687a879ebb"
   condition:
      for any i in (0 .. pe.number_of_signatures) : (
         pe.signatures[i].issuer contains "DigiCert SHA2 Assured ID Code Signing CA" and
         pe.signatures[i].serial == "08:68:70:51:50:f1:cf:c1:fc:c3:fc:91:a4:49:49:a6"
   )
}
YARA Detection Rule: HvS_APT27_HyperBro_Decrypted_Stage2
Repository: Neo23x0/signature-base
Detects: HyperBro Stage 2 and compressed Stage 3 detection
Author: Moritz Oettle
Reference: https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27

Pattern signatures:
$lznt1_compressed_pe_header_small = { FC B9 00 4D 5A 90 } // This is the lznt1 compressed PE header

      $lznt1_compressed_pe_header_large_1 = { FC B9 00 4D 5A 90 00 03 00 00 00 82 04 00 30 FF FF 00 } 
      $lznt1_compressed_pe_header_large_2 = { 00 b8 00 38 0d 01 00 40 04 38 19 00 10 01 00 00 }
      $lznt1_compressed_pe_header_large_3 = { 00 0e 1f ba 0e 00 b4 09 cd 00 21 b8 01 4c cd 21 }
      $lznt1_compressed_pe_header_large_4 = { 54 68 00 69 73 20 70 72 6f 67 72 00 61 6d 20 63 }
      $lznt1_compressed_pe_header_large_5 = { 61 6e 6e 6f 00 74 20 62 65 20 72 75 6e 00 20 69 }
      $lznt1_compressed_pe_header_large_6 = { 6e 20 44 4f 53 20 00 6d 6f 64 65 2e 0d 0d 0a 02 }

Detection condition:
filesize < 200KB and
      ($lznt1_compressed_pe_header_small at 0x9ce) or (all of ($lznt1_compressed_pe_header_large_*))

Full rule:
rule HvS_APT27_HyperBro_Decrypted_Stage2 {
   meta:
      description = "HyperBro Stage 2 and compressed Stage 3 detection"
      license = "https://creativecommons.org/licenses/by-nc/4.0/"
      author = "Moritz Oettle"
      reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
      date = "2022-02-07"
      hash1 = "fc5a58bf0fce9cb96f35ee76842ff17816fe302e3164bc7c6a5ef46f6eff67ed"
      id = "039e5d41-eadb-5c53-82cd-20ffd4105326"
   strings:
      $lznt1_compressed_pe_header_small = { FC B9 00 4D 5A 90 } // This is the lznt1 compressed PE header

      $lznt1_compressed_pe_header_large_1 = { FC B9 00 4D 5A 90 00 03 00 00 00 82 04 00 30 FF FF 00 } 
      $lznt1_compressed_pe_header_large_2 = { 00 b8 00 38 0d 01 00 40 04 38 19 00 10 01 00 00 }
      $lznt1_compressed_pe_header_large_3 = { 00 0e 1f ba 0e 00 b4 09 cd 00 21 b8 01 4c cd 21 }
      $lznt1_compressed_pe_header_large_4 = { 54 68 00 69 73 20 70 72 6f 67 72 00 61 6d 20 63 }
      $lznt1_compressed_pe_header_large_5 = { 61 6e 6e 6f 00 74 20 62 65 20 72 75 6e 00 20 69 }
      $lznt1_compressed_pe_header_large_6 = { 6e 20 44 4f 53 20 00 6d 6f 64 65 2e 0d 0d 0a 02 }

   condition:
      filesize < 200KB and
      ($lznt1_compressed_pe_header_small at 0x9ce) or (all of ($lznt1_compressed_pe_header_large_*))
}
YARA Detection Rule: HvS_APT27_HyperBro_Stage3
Repository: Neo23x0/signature-base
Detects: HyperBro Stage 3 detection - also tested in memory
Author: Markus Poelloth
Reference: https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27

Pattern signatures:
$s1 = "\\cmd.exe /A" wide
      $s2 = "vftrace.dll" fullword wide
      $s3 = "msmpeng.exe" fullword wide
      $s4 = "\\\\.\\pipe\\testpipe" fullword wide
      $s5 = "thumb.dat" fullword wide

      $g1 = "%s\\%d.exe" fullword wide
      $g2 = "https://%s:%d/api/v2/ajax" fullword wide
      $g3 = " -k networkservice" fullword wide
      $g4 = " -k localservice" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and
      (( 4 of ($s*) ) or (4 of ($g*)))

Full rule:
rule HvS_APT27_HyperBro_Stage3 {
   meta:
      description = "HyperBro Stage 3 detection - also tested in memory"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Markus Poelloth"
      reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
      date = "2022-02-07"
      modified = "2023-01-07"
      hash1 = "624e85bd669b97bc55ed5c5ea5f6082a1d4900d235a5d2e2a5683a04e36213e8"
      id = "b4002777-f129-5177-a8f1-690012a207fa"
   strings:
      $s1 = "\\cmd.exe /A" wide
      $s2 = "vftrace.dll" fullword wide
      $s3 = "msmpeng.exe" fullword wide
      $s4 = "\\\\.\\pipe\\testpipe" fullword wide
      $s5 = "thumb.dat" fullword wide

      $g1 = "%s\\%d.exe" fullword wide
      $g2 = "https://%s:%d/api/v2/ajax" fullword wide
      $g3 = " -k networkservice" fullword wide
      $g4 = " -k localservice" fullword wide
      
   condition:
      uint16(0) == 0x5a4d and filesize < 300KB and
      (( 4 of ($s*) ) or (4 of ($g*)))
}
YARA Detection Rule: HvS_APT27_HyperBro_Stage3_C2
Repository: Neo23x0/signature-base
Detects: HyperBro Stage 3 C2 path and user agent detection - also tested in memory
Author: Marc Stroebel
Reference: https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27

Pattern signatures:
$s1 = "api/v2/ajax" ascii wide nocase
      $s2 = "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36" ascii wide nocase

Detection condition:
all of them

Full rule:
rule HvS_APT27_HyperBro_Stage3_C2 {
   meta:
      description = "HyperBro Stage 3 C2 path and user agent detection - also tested in memory"
      license = "https://creativecommons.org/licenses/by-nc/4.0/"
      author = "Marc Stroebel"
      reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
      date = "2022-02-07"
      hash1 = "624e85bd669b97bc55ed5c5ea5f6082a1d4900d235a5d2e2a5683a04e36213e8"
      id = "d1fe03b9-440c-5127-9572-dddcd5c9966b"
   strings:
      $s1 = "api/v2/ajax" ascii wide nocase
      $s2 = "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36" ascii wide nocase
   condition:
      all of them
}
YARA Detection Rule: HvS_APT27_HyperBro_Stage3_Persistence
Repository: Neo23x0/signature-base
Detects: HyperBro Stage 3 registry keys for persistence
Author: Marko Dorfhuber
Reference: https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27

Pattern signatures:
$ = "SOFTWARE\\WOW6432Node\\Microsoft\\config_" ascii
      $ = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\windefenders" ascii

Detection condition:
1 of them

Full rule:
rule HvS_APT27_HyperBro_Stage3_Persistence {
   meta:
      description = "HyperBro Stage 3 registry keys for persistence"
      license = "https://creativecommons.org/licenses/by-nc/4.0/"
      author = "Marko Dorfhuber"
      reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
      date = "2022-02-07"
      hash1 = "624e85bd669b97bc55ed5c5ea5f6082a1d4900d235a5d2e2a5683a04e36213e8"
      id = "2bb1d28b-5fc4-5f0b-b546-c8b8192b0d48"
   strings:
      $ = "SOFTWARE\\WOW6432Node\\Microsoft\\config_" ascii
      $ = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\windefenders" ascii
   condition:
      1 of them
}
YARA Detection Rule: GetUserSPNs_VBS
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file GetUserSPNs.vbs
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/skelsec/PyKerberoast

Pattern signatures:
$s1 = "Wscript.Echo \"User Logon: \" & oRecordset.Fields(\"samAccountName\")" fullword ascii
		$s2 = "Wscript.Echo \" USAGE:        \" & WScript.ScriptName & \" SpnToFind [GC Servername or Forestname]\"" fullword ascii
		$s3 = "strADOQuery = \"<\" + strGCPath + \">;(&(!objectClass=computer)(servicePrincipalName=*));\" & _" fullword ascii

Detection condition:
2 of them

Full rule:
rule GetUserSPNs_VBS {
	meta:
		description = "Auto-generated rule - file GetUserSPNs.vbs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/skelsec/PyKerberoast"
		date = "2016-05-21"
		hash1 = "8dcb568d475fd8a0557e70ca88a262b7c06d0f42835c855b52e059c0f5ce9237"
		id = "5576c1b9-4670-52c5-b23c-64adcc8709de"
	strings:
		$s1 = "Wscript.Echo \"User Logon: \" & oRecordset.Fields(\"samAccountName\")" fullword ascii
		$s2 = "Wscript.Echo \" USAGE:        \" & WScript.ScriptName & \" SpnToFind [GC Servername or Forestname]\"" fullword ascii
		$s3 = "strADOQuery = \"<\" + strGCPath + \">;(&(!objectClass=computer)(servicePrincipalName=*));\" & _" fullword ascii
	condition:
		2 of them
}
YARA Detection Rule: GetUserSPNs_PS1
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file GetUserSPNs.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/skelsec/PyKerberoast

Pattern signatures:
$s1 = "$ForestInfo = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()" fullword ascii
		$s2 = "@{Name=\"PasswordLastSet\";      Expression={[datetime]::fromFileTime($result.Properties[\"pwdlastset\"][0])} } #, `" fullword ascii
		$s3 = "Write-Host \"No Global Catalogs Found!\"" fullword ascii
		$s4 = "$searcher.PropertiesToLoad.Add(\"pwdlastset\") | Out-Null" fullword ascii

Detection condition:
2 of them

Full rule:
rule GetUserSPNs_PS1 {
	meta:
		description = "Auto-generated rule - file GetUserSPNs.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/skelsec/PyKerberoast"
		date = "2016-05-21"
		hash1 = "1b69206b8d93ac86fe[PII_REDACTED]23f4b1544fff7eb1ea544ab8912c436ddc04"
		id = "a2fba75c-264f-5e89-afaf-9d19a4a90784"
	strings:
		$s1 = "$ForestInfo = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()" fullword ascii
		$s2 = "@{Name=\"PasswordLastSet\";      Expression={[datetime]::fromFileTime($result.Properties[\"pwdlastset\"][0])} } #, `" fullword ascii
		$s3 = "Write-Host \"No Global Catalogs Found!\"" fullword ascii
		$s4 = "$searcher.PropertiesToLoad.Add(\"pwdlastset\") | Out-Null" fullword ascii
	condition:
		2 of them
}
YARA Detection Rule: kerberoast_PY
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file kerberoast.py
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/skelsec/PyKerberoast

Pattern signatures:
$s1 = "newencserverticket = kerberos.encrypt(key, 2, encoder.encode(decserverticket), nonce)" fullword ascii
		$s2 = "key = kerberos.ntlmhash(args.password)" fullword ascii
		$s3 = "help='the password used to decrypt/encrypt the ticket')" fullword ascii
      $s4 = "newencserverticket = kerberos.encrypt(key, 2, e, nonce)" fullword ascii

Detection condition:
2 of them

Full rule:
rule kerberoast_PY {
	meta:
		description = "Auto-generated rule - file kerberoast.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/skelsec/PyKerberoast"
		date = "2016-05-21"
		hash1 = "73155949b4344db2ae511ec8cab85da1ccbf2dfec3607fb9acdc281357cdf380"
		id = "cea6cdb2-cd1a-5701-a9d1-27c788a962a7"
	strings:
		$s1 = "newencserverticket = kerberos.encrypt(key, 2, encoder.encode(decserverticket), nonce)" fullword ascii
		$s2 = "key = kerberos.ntlmhash(args.password)" fullword ascii
		$s3 = "help='the password used to decrypt/encrypt the ticket')" fullword ascii
      $s4 = "newencserverticket = kerberos.encrypt(key, 2, e, nonce)" fullword ascii
	condition:
		2 of them
}
YARA Detection Rule: Dropper_DeploysMalwareViaSideLoading
Repository: Neo23x0/signature-base
Detects: Detects a dropper used to deploy an implant via side loading. This dropper has specifically been observed deploying REDLEAVES & PlugX
Author: USG
Reference: https://www.us-cert.gov/ncas/alerts/TA17-117A

Pattern signatures:
$UniqueString = {2e 6c 6e 6b [0-14] 61 76 70 75 69 2e 65 78 65} // ".lnk" near "avpui.exe"
        $PsuedoRandomStringGenerator = {b9 1a [0-6] f7 f9 46 80 c2 41 88 54 35 8b 83 fe 64} // Unique function that generates a 100 character pseudo random string.

Detection condition:
any of them

Full rule:
rule Dropper_DeploysMalwareViaSideLoading {
    meta:
        description = "Detects a dropper used to deploy an implant via side loading. This dropper has specifically been observed deploying REDLEAVES & PlugX"
        author = "USG"
        reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
        true_positive = "5262cb9791df50fafcb2fbd5f93226050b51efe400c2924eecba97b7ce437481: drops REDLEAVES. 6392e0701a77ea25354b1f40f5b867a35c0142abde785a66b83c9c8d2c14c0c3: drops plugx. "
        id = "2e7cdedd-2358-5d71-a3ec-73dec442d840"
    strings:
        $UniqueString = {2e 6c 6e 6b [0-14] 61 76 70 75 69 2e 65 78 65} // ".lnk" near "avpui.exe"
        $PsuedoRandomStringGenerator = {b9 1a [0-6] f7 f9 46 80 c2 41 88 54 35 8b 83 fe 64} // Unique function that generates a 100 character pseudo random string.
    condition:
        any of them
}
YARA Detection Rule: REDLEAVES_DroppedFile_ImplantLoader_Starburn
Repository: Neo23x0/signature-base
Detects: Detects the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT
Author: USG
Reference: https://www.us-cert.gov/ncas/alerts/TA17-117A

Pattern signatures:
$XOR_Loop = {32 0c 3a 83 c2 02 88 0e 83 fa 08 [4-14] 32 0c 3a 83 c2 02 88 0e 83 fa 10} // Deobfuscation loop

Detection condition:
any of them

Full rule:
rule REDLEAVES_DroppedFile_ImplantLoader_Starburn {
    meta:
        description = "Detects the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT"
        author = "USG"
        reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
        true_positive = "7f8a867a8302fe58039a6db254d335ae" // StarBurn.dll
        id = "976f42b1-58c9-554b-97e6-130a657507e2"
    strings:
        $XOR_Loop = {32 0c 3a 83 c2 02 88 0e 83 fa 08 [4-14] 32 0c 3a 83 c2 02 88 0e 83 fa 10} // Deobfuscation loop
    condition:
        any of them
}
YARA Detection Rule: REDLEAVES_DroppedFile_ObfuscatedShellcodeAndRAT_handkerchief
Repository: Neo23x0/signature-base
Detects: Detects obfuscated .dat file containing shellcode and core REDLEAVES RAT
Author: USG
Reference: https://www.us-cert.gov/ncas/alerts/TA17-117A

Pattern signatures:
$RedleavesStringObfu = {73 64 65 5e 60 74 75 74 6c 6f 60 6d 5e 6d 64 60 77 64 72 5e 65 6d 6d 6c 60 68 6f 2f 65 6d 6d} // This is 'red_autumnal_leaves_dllmain.dll' XOR'd with 0x01

Detection condition:
any of them

Full rule:
rule REDLEAVES_DroppedFile_ObfuscatedShellcodeAndRAT_handkerchief {
    meta:
        description = "Detects obfuscated .dat file containing shellcode and core REDLEAVES RAT"
        author = "USG"
        reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
        true_positive = "fb0c714cd2ebdcc6f33817abe7813c36" // handkerchief.dat
        id = "51a28529-1084-5f24-9369-6427e8d51d9d"
    strings:
        $RedleavesStringObfu = {73 64 65 5e 60 74 75 74 6c 6f 60 6d 5e 6d 64 60 77 64 72 5e 65 6d 6d 6c 60 68 6f 2f 65 6d 6d} // This is 'red_autumnal_leaves_dllmain.dll' XOR'd with 0x01
    condition:
        any of them
}