deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: StuxNet_dll
Repository: Yara-Rules/rules
Detects: Stuxnet Sample - file dll.dll
Author: Florian Roth
Reference: Internal Research

Pattern signatures:
$s1 = "SUCKM3 FROM EXPLORER.EXE MOTH4FUCKA #@!" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and $s1

Full rule:
rule StuxNet_dll 
{

    meta:
        description = "Stuxnet Sample - file dll.dll"
        author = "Florian Roth"
        reference = "Internal Research"
        date = "2016-07-09"
        hash1 = "9e392277f62206098cf794ddebafd2817483cfd57ec03c2e05e7c3c81e72f562"

    strings:
        $s1 = "SUCKM3 FROM EXPLORER.EXE MOTH4FUCKA #@!" fullword ascii
    
    condition:
        uint16(0) == 0x5a4d and filesize < 100KB and $s1
}
YARA Detection Rule: Stuxnet_Shortcut_to
Repository: Yara-Rules/rules
Detects: Stuxnet Sample - file Copy of Shortcut to.lnk
Author: Florian Roth
Reference: Internal Research

Pattern signatures:
$x1 = "\\\\.\\STORAGE#Volume#_??_USBSTOR#Disk&Ven_Kingston&Prod_DataTraveler_2.0&Rev_PMAP#5B6B098B97BE&0#{53f56307-b6bf-11d0-94f2-00a0c" wide

Detection condition:
uint16(0) == 0x004c and filesize < 10KB and $x1

Full rule:
rule Stuxnet_Shortcut_to 
{

    meta:
        description = "Stuxnet Sample - file Copy of Shortcut to.lnk"
        author = "Florian Roth"
        reference = "Internal Research"
        date = "2016-07-09"
        hash1 = "801e3b6d84862163a735502f93b9663be53ccbdd7f12b0707336fecba3a829a2"

    strings:
        $x1 = "\\\\.\\STORAGE#Volume#_??_USBSTOR#Disk&Ven_Kingston&Prod_DataTraveler_2.0&Rev_PMAP#5B6B098B97BE&0#{53f56307-b6bf-11d0-94f2-00a0c" wide

    condition:
        uint16(0) == 0x004c and filesize < 10KB and $x1
}
YARA Detection Rule: Stuxnet_Malware_3
Repository: Yara-Rules/rules
Detects: Stuxnet Sample - file ~WTR4141.tmp
Author: Florian Roth
Reference: Internal Research

Pattern signatures:
$x1 = "SHELL32.DLL.ASLR." fullword wide
        $s1 = "~WTR4141.tmp" fullword wide
        $s2 = "~WTR4132.tmp" fullword wide
        $s3 = "totalcmd.exe" fullword wide
        $s4 = "wincmd.exe" fullword wide
        $s5 = "http://www.realtek.com0" fullword ascii
        $s6 = "{%08x-%08x-%08x-%08x}" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 150KB and ( $x1 or 3 of ($s*) ) ) or ( 5 of them )

Full rule:
rule Stuxnet_Malware_3 
{

    meta:
        description = "Stuxnet Sample - file ~WTR4141.tmp"
        author = "Florian Roth"
        reference = "Internal Research"
        date = "2016-07-09"
        hash1 = "6bcf88251c876ef00b2f32cf97456a3e306c2a263d487b0a50216c6e3cc07c6a"
        hash2 = "70f8789b03e38d07584f57581363afa848dd5c3a197f2483c6dfa4f3e7f78b9b"

    strings:
        $x1 = "SHELL32.DLL.ASLR." fullword wide
        $s1 = "~WTR4141.tmp" fullword wide
        $s2 = "~WTR4132.tmp" fullword wide
        $s3 = "totalcmd.exe" fullword wide
        $s4 = "wincmd.exe" fullword wide
        $s5 = "http://www.realtek.com0" fullword ascii
        $s6 = "{%08x-%08x-%08x-%08x}" fullword wide

    condition:
        ( uint16(0) == 0x5a4d and filesize < 150KB and ( $x1 or 3 of ($s*) ) ) or ( 5 of them )
}
YARA Detection Rule: Stuxnet_Malware_4
Repository: Yara-Rules/rules
Detects: Stuxnet Sample - file 0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198
Author: Florian Roth
Reference: Internal Research

Pattern signatures:
$x1 = "\\objfre_w2k_x86\\i386\\guava.pdb" ascii
        $x2 = "MRxCls.sys" fullword wide
        $x3 = "MRXNET.Sys" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 80KB and 1 of them ) or ( all of them )

Full rule:
rule Stuxnet_Malware_4 
{

    meta:
        description = "Stuxnet Sample - file 0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198"
        author = "Florian Roth"
        reference = "Internal Research"
        date = "2016-07-09"
        hash1 = "0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198"
        hash2 = "1635ec04f069ccc8331d01fdf31132a4bc8f6fd3830ac94739df95ee093c555c"
   
    strings:
        $x1 = "\\objfre_w2k_x86\\i386\\guava.pdb" ascii
        $x2 = "MRxCls.sys" fullword wide
        $x3 = "MRXNET.Sys" fullword wide
   
    condition:
        ( uint16(0) == 0x5a4d and filesize < 80KB and 1 of them ) or ( all of them )
}
YARA Detection Rule: Stuxnet_maindll_decrypted_unpacked
Repository: Yara-Rules/rules
Detects: Stuxnet Sample - file maindll.decrypted.unpacked.dll_
Author: Florian Roth
Reference: Internal Research

Pattern signatures:
$s1 = "%SystemRoot%\\system32\\Drivers\\mrxsmb.sys;%SystemRoot%\\system32\\Drivers\\*.sys" fullword wide
        $s2 = "<Actions Context=\"%s\"><Exec><Command>%s</Command><Arguments>%s,#%u</Arguments></Exec></Actions>" fullword wide
        $s3 = "%SystemRoot%\\inf\\oem7A.PNF" fullword wide
        $s4 = "%SystemRoot%\\inf\\mdmcpq3.PNF" fullword wide
        $s5 = "%SystemRoot%\\inf\\oem6C.PNF" fullword wide
        $s6 = "@abf varbinary(4096) EXEC @hr = sp_OACreate 'ADODB.Stream', @aods OUT IF @hr <> 0 GOTO endq EXEC @hr = sp_OASetProperty @" wide
        $s7 = "STORAGE#Volume#1&19f7e59c&0&" fullword wide
        $s8 = "view MCPVREADVARPERCON as select VARIABLEID,VARIABLETYPEID,FORMATFITTING,SCALEID,VARIABLENAME,ADDRESSPARAMETER,PROTOKOLL,MAXLIMI" ascii

Detection condition:
6 of them

Full rule:
rule Stuxnet_maindll_decrypted_unpacked 
{

    meta:
        description = "Stuxnet Sample - file maindll.decrypted.unpacked.dll_"
        author = "Florian Roth"
        reference = "Internal Research"
        date = "2016-07-09"
        hash1 = "4c3d7b38339d7b8adf73eaf85f0eb9fab4420585c6ab6950ebd360428af11712"

    strings:
        $s1 = "%SystemRoot%\\system32\\Drivers\\mrxsmb.sys;%SystemRoot%\\system32\\Drivers\\*.sys" fullword wide
        $s2 = "<Actions Context=\"%s\"><Exec><Command>%s</Command><Arguments>%s,#%u</Arguments></Exec></Actions>" fullword wide
        $s3 = "%SystemRoot%\\inf\\oem7A.PNF" fullword wide
        $s4 = "%SystemRoot%\\inf\\mdmcpq3.PNF" fullword wide
        $s5 = "%SystemRoot%\\inf\\oem6C.PNF" fullword wide
        $s6 = "@abf varbinary(4096) EXEC @hr = sp_OACreate 'ADODB.Stream', @aods OUT IF @hr <> 0 GOTO endq EXEC @hr = sp_OASetProperty @" wide
        $s7 = "STORAGE#Volume#1&19f7e59c&0&" fullword wide
        $s8 = "view MCPVREADVARPERCON as select VARIABLEID,VARIABLETYPEID,FORMATFITTING,SCALEID,VARIABLENAME,ADDRESSPARAMETER,PROTOKOLL,MAXLIMI" ascii

    condition:
         6 of them
}
YARA Detection Rule: Stuxnet_s7hkimdb
Repository: Yara-Rules/rules
Detects: Stuxnet Sample - file s7hkimdb.dll
Author: Florian Roth
Reference: Internal Research

Pattern signatures:
$x1 = "S7HKIMDX.DLL" fullword wide

        /* Opcodes by Binar.ly */

        // 0x10001778 8b 45 08  mov     eax, dword ptr [ebp + 8]
        // 0x1000177b 35 dd 79 19 ae    xor     eax, 0xae1979dd
        // 0x10001780 33 c9     xor     ecx, ecx
        // 0x10001782 8b 55 08  mov     edx, dword ptr [ebp + 8]
        // 0x10001785 89 02     mov     dword ptr [edx], eax
        // 0x10001787 89 ?? ??  mov     dword ptr [edx + 4], ecx
        $op1 = { 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 }
        // 0x10002045 74 36     je      0x1000207d
        // 0x10002047 8b 7f 08  mov     edi, dword ptr [edi + 8]
        // 0x1000204a 83 ff 00  cmp     edi, 0
        // 0x1000204d 74 2e     je      0x1000207d
        // 0x1000204f 0f b7 1f  movzx   ebx, word ptr [edi]
        // 0x10002052 8b 7f 04  mov     edi, dword ptr [edi + 4]
        $op2 = { 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 }
        // 0x100020cf 74 70     je      0x10002141
        // 0x100020d1 81 78 05 8d 54

Detection condition:
( uint16(0) == 0x5a4d and filesize < 40KB and $x1 and all of ($op*) )

Full rule:
rule Stuxnet_s7hkimdb 
{

    meta:
        description = "Stuxnet Sample - file s7hkimdb.dll"
        author = "Florian Roth"
        reference = "Internal Research"
        date = "2016-07-09"
        hash1 = "4071ec265a44d1f0d42ff92b2fa0b30aafa7f6bb2160ed1d0d5372d70ac654bd"

    strings:
        $x1 = "S7HKIMDX.DLL" fullword wide

        /* Opcodes by Binar.ly */

        // 0x10001778 8b 45 08  mov     eax, dword ptr [ebp + 8]
        // 0x1000177b 35 dd 79 19 ae    xor     eax, 0xae1979dd
        // 0x10001780 33 c9     xor     ecx, ecx
        // 0x10001782 8b 55 08  mov     edx, dword ptr [ebp + 8]
        // 0x10001785 89 02     mov     dword ptr [edx], eax
        // 0x10001787 89 ?? ??  mov     dword ptr [edx + 4], ecx
        $op1 = { 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 }
        // 0x10002045 74 36     je      0x1000207d
        // 0x10002047 8b 7f 08  mov     edi, dword ptr [edi + 8]
        // 0x1000204a 83 ff 00  cmp     edi, 0
        // 0x1000204d 74 2e     je      0x1000207d
        // 0x1000204f 0f b7 1f  movzx   ebx, word ptr [edi]
        // 0x10002052 8b 7f 04  mov     edi, dword ptr [edi + 4]
        $op2 = { 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 }
        // 0x100020cf 74 70     je      0x10002141
        // 0x100020d1 81 78 05 8d 54 24 04      cmp     dword ptr [eax + 5], 0x424548d
        // 0x100020d8 75 1b     jne     0x100020f5
        // 0x100020da 81 78 08 04 cd ?? ??      cmp     dword ptr [eax + 8], 0xc22ecd04
        $op3 = { 74 70 81 78 05 8d 54 24 04 75 1b 81 78 08 04 cd }

    condition:
        ( uint16(0) == 0x5a4d and filesize < 40KB and $x1 and all of ($op*) )
}
YARA Detection Rule: Stuxnet_MadeInPython
Repository: Yara-Rules/rules
Detects: Python has been used frequently by threat actors for compiling executable file with source code. I found python Stuxnet source code that can be executed with required dependencies. This rule is created in hopes to catch potental breakout of future Stuxnet.
Author: Jin Kim
Reference: https://github.com/kenmueller/stuxnet

Pattern signatures:
// main function include this call stack as a second function call.
        $str1 = "old_infected_attributes = node_infected_attributes(graph)"
    //     def node_total_attributes(graph: nx.Graph) -> dict:
	// filter_for_node_type = lambda node_type: list(filter(lambda node: get_node_type(graph, node) == node_type, graph.node))
	// return {
	// 	NodeType.COMPUTER: len(filter_for_node_type(NodeType.COMPUTER)),
	// 	NodeType.DISCONNECTED_COMPUTER: len(filter_for_node_type(NodeType.DISCONNECTED_COMPUTER)),
	// 	NodeType.USB: len(filter_for_node_type(NodeType.USB)),
	// 	NodeType.PLC: len(filter_for_node_type(NodeType.PLC)),
	// 	'total': len(graph.node)
        $str2 = "NodeType.DISCONNECTED_COMPUTER"

    // found in create-graph.py
    // This line adds router nodes and computer nodes fro all the wireless networks.
    // for router_node in range(NUMBER_OF_LOCAL_WIRED_NETWORKS, NUMBER_OF_LOCAL_NETWORKS):
		// add_computer_nodes(graph, EdgeType.LOCAL_WIRELESS, router_node)
        $str3

Detection condition:
any of them

Full rule:
rule Stuxnet_MadeInPython
{
    meta:
        description = "Python has been used frequently by threat actors for compiling executable file with source code. I found python Stuxnet source code that can be executed with required dependencies. This rule is created in hopes to catch potental breakout of future Stuxnet."
        author = "Jin Kim"
        reference = "https://github.com/kenmueller/stuxnet"
        date = "2020-12-23"
    
    strings:
    // main function include this call stack as a second function call.
        $str1 = "old_infected_attributes = node_infected_attributes(graph)"
    //     def node_total_attributes(graph: nx.Graph) -> dict:
	// filter_for_node_type = lambda node_type: list(filter(lambda node: get_node_type(graph, node) == node_type, graph.node))
	// return {
	// 	NodeType.COMPUTER: len(filter_for_node_type(NodeType.COMPUTER)),
	// 	NodeType.DISCONNECTED_COMPUTER: len(filter_for_node_type(NodeType.DISCONNECTED_COMPUTER)),
	// 	NodeType.USB: len(filter_for_node_type(NodeType.USB)),
	// 	NodeType.PLC: len(filter_for_node_type(NodeType.PLC)),
	// 	'total': len(graph.node)
        $str2 = "NodeType.DISCONNECTED_COMPUTER"

    // found in create-graph.py
    // This line adds router nodes and computer nodes fro all the wireless networks.
    // for router_node in range(NUMBER_OF_LOCAL_WIRED_NETWORKS, NUMBER_OF_LOCAL_NETWORKS):
		// add_computer_nodes(graph, EdgeType.LOCAL_WIRELESS, router_node)
        $str3 = "add_computer_nodes(graph, EdgeType.LOCAL_WIRELESS, router_node)"
    
    condition:
        any of them
}
YARA Detection Rule: pony
Repository: Yara-Rules/rules
Detects: Identify Pony
Author: Brian Wallace @botnet_hunter

Pattern signatures:
$s1 = "{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}"
    	$s2 = "YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0"
    	$s3 = "POST %s HTTP/1.0"
    	$s4 = "Accept-Encoding: identity, *;q=0"

    	//$useragent1 = "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)"
    	//$useragent2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0)"

Detection condition:
$s1 and $s2 and $s3 and $s4

Full rule:
rule pony {
    meta:
        author = "Brian Wallace @botnet_hunter"
        author_email = "bwall@ballastsecurity.net"
        date = "2014-08-16"
        description = "Identify Pony"
	strings:
    	$s1 = "{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}"
    	$s2 = "YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0"
    	$s3 = "POST %s HTTP/1.0"
    	$s4 = "Accept-Encoding: identity, *;q=0"

    	//$useragent1 = "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)"
    	//$useragent2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0)"
    condition:
        $s1 and $s2 and $s3 and $s4
}
YARA Detection Rule: screenlocker_5h311_1nj3c706
Repository: Yara-Rules/rules
Detects: Rule to detect the screenlocker 5h311_1nj3c706
Author: Marc Rivero | @seifreed
Reference: https://twitter.com/demonslay335/status/[PII_REDACTED]61266944

Pattern signatures:
$s1 = "C:\\Users\\Hoang Nam\\source\\repos\\WindowsApp22\\WindowsApp22\\obj\\Debug\\WindowsApp22.pdb" fullword ascii
      $s2 = "cmd.exe /cREG add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\ActiveDesktop /v NoChangingWallPaper /t REG_DWOR" wide
      $s3 = "C:\\Users\\file1.txt" fullword wide
      $s4 = "C:\\Users\\file2.txt" fullword wide
      $s5 = "C:\\Users\\file.txt" fullword wide
      $s6 = " /v Wallpaper /t REG_SZ /d %temp%\\IMG.jpg /f" fullword wide
      $s7 = " /v DisableAntiSpyware /t REG_DWORD /d 1 /f" fullword wide
      $s8 = "All your file has been locked. You must pay money to have a key." fullword wide
      $s9 = "After we receive Bitcoin from you. We will send key to your email." fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB ) and all of them

Full rule:
rule screenlocker_5h311_1nj3c706 {

   meta:

      description = "Rule to detect the screenlocker 5h311_1nj3c706"
      author = "Marc Rivero | @seifreed"
      reference = "https://twitter.com/demonslay335/status/[PII_REDACTED]61266944"

   strings:

      $s1 = "C:\\Users\\Hoang Nam\\source\\repos\\WindowsApp22\\WindowsApp22\\obj\\Debug\\WindowsApp22.pdb" fullword ascii
      $s2 = "cmd.exe /cREG add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\ActiveDesktop /v NoChangingWallPaper /t REG_DWOR" wide
      $s3 = "C:\\Users\\file1.txt" fullword wide
      $s4 = "C:\\Users\\file2.txt" fullword wide
      $s5 = "C:\\Users\\file.txt" fullword wide
      $s6 = " /v Wallpaper /t REG_SZ /d %temp%\\IMG.jpg /f" fullword wide
      $s7 = " /v DisableAntiSpyware /t REG_DWORD /d 1 /f" fullword wide
      $s8 = "All your file has been locked. You must pay money to have a key." fullword wide
      $s9 = "After we receive Bitcoin from you. We will send key to your email." fullword wide
   
   condition:

      ( uint16(0) == 0x5a4d and filesize < 200KB ) and all of them 
}
YARA Detection Rule: sendsafe
Repository: Yara-Rules/rules
Author:  J from THL <j@techhelplist.com>
Reference: http://pastebin.com/WPWWs406

Pattern signatures:
$a = "Enterprise Mailing Service"
        $b = "Blacklisted by rule: %s:%s"
        $c = "/SuccessMails?CampaignNum=%ld"
        $d = "/TimedOutMails?CampaignNum=%ld"
        $e = "/InvalidMails?CampaignNum=%ld"
        $f = "Failed to download maillist, retrying"
        $g = "No maillist loaded"
        $h = "Successfully sent using SMTP account %s (%d of %ld messages to %s)"
        $i = "Successfully sent %d of %ld messages to %s"
        $j = "Sending to %s in the same connection"
        $k = "New connection required, will send to %s"
		$l = "Mail transaction for %s is over."
		$m = "Domain %s is bad (found in cache)"
		$n = "Domain %s found in cache"
		$o = "Domain %s isn't found in cache, resolving it"
		$p = "All tries to resolve %s failed."
		$q = "Failed to receive response for %s from DNS server"
		$r = "Got DNS server response: domain %s is bad"
		$s = "Got error %d in response for %s from DNS server"
		$t = "MX's IP for domain %s found in cache:"
		$u = "Timeout waiting f

Detection condition:
13 of them

Full rule:
rule sendsafe {

    meta:
        author = " J from THL <j@techhelplist.com>"
        date = "2016/09"
        reference = "http://pastebin.com/WPWWs406"
		version = 2
        maltype = "Spammer"
        filetype = "memory"

    strings:
        $a = "Enterprise Mailing Service"
        $b = "Blacklisted by rule: %s:%s"
        $c = "/SuccessMails?CampaignNum=%ld"
        $d = "/TimedOutMails?CampaignNum=%ld"
        $e = "/InvalidMails?CampaignNum=%ld"
        $f = "Failed to download maillist, retrying"
        $g = "No maillist loaded"
        $h = "Successfully sent using SMTP account %s (%d of %ld messages to %s)"
        $i = "Successfully sent %d of %ld messages to %s"
        $j = "Sending to %s in the same connection"
        $k = "New connection required, will send to %s"
		$l = "Mail transaction for %s is over."
		$m = "Domain %s is bad (found in cache)"
		$n = "Domain %s found in cache"
		$o = "Domain %s isn't found in cache, resolving it"
		$p = "All tries to resolve %s failed."
		$q = "Failed to receive response for %s from DNS server"
		$r = "Got DNS server response: domain %s is bad"
		$s = "Got error %d in response for %s from DNS server"
		$t = "MX's IP for domain %s found in cache:"
		$u = "Timeout waiting for domain %s to be resolved"
		$v = "No valid MXes for domain %s. Marking it as bad"
		$w = "Resolving MX %s using existing connection to DNS server"
		$x = "All tries to resolve MX for %s are failed"
		$y = "Resolving MX %s using DNS server"
		$z = "Failed to receive response for MX %s from DNS server"

    condition:
        13 of them
}
YARA Detection Rule: APT3102Code
Repository: Yara-Rules/rules
Detects: 3102 code features
Author: Seth Hardy

Pattern signatures:
$setupthread = { B9 02 07 00 00 BE ?? ?? ?? ?? 8B F8 6A 00 F3 A5 }

Detection condition:
any of them

Full rule:
rule APT3102Code
{

    meta:
        description = "3102 code features"
        author = "Seth Hardy"
        last_modified = "2014-06-25"

    strings:
        $setupthread = { B9 02 07 00 00 BE ?? ?? ?? ?? 8B F8 6A 00 F3 A5 }

    condition:
        any of them
}
YARA Detection Rule: APT3102Strings
Repository: Yara-Rules/rules
Detects: 3102 Identifying Strings
Author: Seth Hardy

Pattern signatures:
$ = "rundll32_exec.dll\x00Update"
        // this is in the encrypted code - shares with 9002 variant
        //$ = "POST http://%ls:%d/%x HTTP/1.1"

Detection condition:
any of them

Full rule:
rule APT3102Strings
{
    
    meta:
        description = "3102 Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-06-25"

    strings:
        $ = "rundll32_exec.dll\x00Update"
        // this is in the encrypted code - shares with 9002 variant
        //$ = "POST http://%ls:%d/%x HTTP/1.1"

    condition:
       any of them
}
YARA Detection Rule: pico_ransomware
Repository: Yara-Rules/rules
Detects: Rule to detect Pico Ransomware
Author: Marc Rivero | @seifreed
Reference: https://twitter.com/siri_urz/status/[PII_REDACTED]34557184

Pattern signatures:
$s1 = "C:\\Users\\rikfe\\Desktop\\Ransomware\\ThanatosSource\\Release\\Ransomware.pdb" fullword ascii
      $s2 = "\\Downloads\\README.txt" fullword ascii
      $s3 = "\\Music\\README.txt" fullword ascii
      $s4 = "\\Videos\\README.txt" fullword ascii
      $s5 = "\\Pictures\\README.txt" fullword ascii
      $s6 = "\\Desktop\\README.txt" fullword ascii
      $s7 = "\\Documents\\README.txt" fullword ascii
      $s8 = "/c taskkill /im " fullword ascii
      $s9 = "\\AppData\\Roaming\\" fullword ascii
      $s10 = "gMozilla/5.0 (Windows NT 6.1) Thanatos/1.1" fullword wide
      $s11 = "AppData\\Roaming" fullword ascii
      $s12 = "\\Downloads" fullword ascii
      $s13 = "operator co_await" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 700KB ) and all of them

Full rule:
rule pico_ransomware {
   
   meta:
   
      description = "Rule to detect Pico Ransomware"
      author = "Marc Rivero | @seifreed"
      reference = "https://twitter.com/siri_urz/status/[PII_REDACTED]34557184"
      
   strings:

      $s1 = "C:\\Users\\rikfe\\Desktop\\Ransomware\\ThanatosSource\\Release\\Ransomware.pdb" fullword ascii
      $s2 = "\\Downloads\\README.txt" fullword ascii
      $s3 = "\\Music\\README.txt" fullword ascii
      $s4 = "\\Videos\\README.txt" fullword ascii
      $s5 = "\\Pictures\\README.txt" fullword ascii
      $s6 = "\\Desktop\\README.txt" fullword ascii
      $s7 = "\\Documents\\README.txt" fullword ascii
      $s8 = "/c taskkill /im " fullword ascii
      $s9 = "\\AppData\\Roaming\\" fullword ascii
      $s10 = "gMozilla/5.0 (Windows NT 6.1) Thanatos/1.1" fullword wide
      $s11 = "AppData\\Roaming" fullword ascii
      $s12 = "\\Downloads" fullword ascii
      $s13 = "operator co_await" fullword ascii
   
   condition:
      ( uint16(0) == 0x5a4d and filesize < 700KB ) and all of them
}
YARA Detection Rule: CrossRAT
Repository: Yara-Rules/rules
Detects: Detects CrossRAT known hash
Author: Simon Sigre (simon.sigre@gmail.com)

Pattern signatures:
$magic = { 50 4b 03 04 ( 14 | 0a ) 00 }
        $string_1 = "META-INF/"
        $string_2 = ".class" nocase

Detection condition:
filesize < 400KB and
        $magic at 0 and 1 of ($string_*) and
        hash.md5(0, filesize) == "85b794e080d83a91e904b97769e1e770"

Full rule:
rule CrossRAT: RAT
{
    meta:
        description = "Detects CrossRAT known hash"
        author = "Simon Sigre (simon.sigre@gmail.com)"
        date = "26/01/2018"
        ref = "https://simonsigre.com"
        ref= "https://objective-see.com/blog/blog_0x28.html"
    strings:
        $magic = { 50 4b 03 04 ( 14 | 0a ) 00 }
        $string_1 = "META-INF/"
        $string_2 = ".class" nocase

    condition:
        filesize < 400KB and
        $magic at 0 and 1 of ($string_*) and
        hash.md5(0, filesize) == "85b794e080d83a91e904b97769e1e770"
}
YARA Detection Rule: Dropper_DeploysMalwareViaSideLoading
Repository: Yara-Rules/rules
Detects: Detect a dropper used to deploy an implant via side loading. This dropper has specifically been observed deploying REDLEAVES & PlugX
Author: USG
Reference: https://www.us-cert.gov/ncas/alerts/TA17-117A

Pattern signatures:
$UniqueString = {2e 6c 6e 6b [0-14] 61 76 70 75 69 2e 65 78 65} // ".lnk" near "avpui.exe"
        $PsuedoRandomStringGenerator = {b9 1a [0-6] f7 f9 46 80 c2 41 88 54 35 8b 83 fe 64} // Unique function that generates a 100 character pseudo random string.

Detection condition:
any of them

Full rule:
rule Dropper_DeploysMalwareViaSideLoading {
meta:
        description = "Detect a dropper used to deploy an implant via side loading. This dropper has specifically been observed deploying REDLEAVES & PlugX"
        author = "USG"
        true_positive = "5262cb9791df50fafcb2fbd5f93226050b51efe400c2924eecba97b7ce437481: drops REDLEAVES. 6392e0701a77ea25354b1f40f5b867a35c0142abde785a66b83c9c8d2c14c0c3: drops plugx. "
        reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"

strings:
        $UniqueString = {2e 6c 6e 6b [0-14] 61 76 70 75 69 2e 65 78 65} // ".lnk" near "avpui.exe"
        $PsuedoRandomStringGenerator = {b9 1a [0-6] f7 f9 46 80 c2 41 88 54 35 8b 83 fe 64} // Unique function that generates a 100 character pseudo random string.

condition:
        any of them
}