deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: md5_3ccdd51fe616c08daafd601589182d38
Repository: Yara-Rules/rules

Pattern signatures:
$ = "eval(xxtea_decrypt"

Detection condition:
any of them

Full rule:
rule md5_3ccdd51fe616c08daafd601589182d38 {
    strings: $ = "eval(xxtea_decrypt"
    condition: any of them
}
YARA Detection Rule: md5_4b69af81b89ba444204680d506a8e0a1
Repository: Yara-Rules/rules

Pattern signatures:
$ = "** Scam Redirector"

Detection condition:
any of them

Full rule:
rule md5_4b69af81b89ba444204680d506a8e0a1 {
    strings: $ = "** Scam Redirector"
    condition: any of them
}
YARA Detection Rule: md5_71a7c769e644d8cf3cf[PII_REDACTED]2c7
Repository: Yara-Rules/rules

Pattern signatures:
$ = /\$GLOBALS\['[\w\d]+'\]\(\$GLOBALS\['[\w\d]+'\]/

Detection condition:
any of them

Full rule:
rule md5_71a7c769e644d8cf3cf[PII_REDACTED]2c7 {
	/*
    // $GLOBALS['ywanc2']($GLOBALS['ggbdg61']
    */
    strings: $ = /\$GLOBALS\['[\w\d]+'\]\(\$GLOBALS\['[\w\d]+'\]/
    condition: any of them
}
YARA Detection Rule: md5_825a3b2a6abbe6abcdeda64a73416b3d
Repository: Yara-Rules/rules

Pattern signatures:
$ = "$ooooo00oo0000oo0"
    */
    strings: $ = /[o0O]{3}\("fsockopen"\)/

Detection condition:
any of them

Full rule:
rule md5_825a3b2a6abbe6abcdeda64a73416b3d {
	/*
    // $ooooo00oo0000oo0oo0oo00ooo0ooo0o0o0 = gethostbyname($_SERVER["SERVER_NAME"]);
    // if(!oo00o0OOo0o00O("fsockopen"))
    // strings: $ = "$ooooo00oo0000oo0"
    */
    strings: $ = /[o0O]{3}\("fsockopen"\)/
    condition: any of them
}
YARA Detection Rule: md5_87cf8209494eedd936b28ff620e28780
Repository: Yara-Rules/rules

Pattern signatures:
$ = "curl_close($cu);eval($o);};die();"

Detection condition:
any of them

Full rule:
rule md5_87cf8209494eedd936b28ff620e28780 {
    strings: $ = "curl_close($cu);eval($o);};die();"
    condition: any of them
}
YARA Detection Rule: md5_9b59cb5b557e46e1487ef891cedaccf7
Repository: Yara-Rules/rules

Pattern signatures:
$jpg = { FF D8 FF E0 ?? ?? 4A 46 49 46 00 01 }
		/*
        // https://en.wikipedia.org/wiki/List_of_file_signatures
        // magic module is not standard compiled in on our platform
        // otherwise:

Detection condition:
magic.mime_type() == /^image/
        // $jpg = { 4A 46 49 46 00 01 }
        */
        $php = "<?php"
    condition: ($jpg at 0) and $php

Full rule:
rule md5_9b59cb5b557e46e1487ef891cedaccf7 {
    strings: 
        $jpg = { FF D8 FF E0 ?? ?? 4A 46 49 46 00 01 }
		/*
        // https://en.wikipedia.org/wiki/List_of_file_signatures
        // magic module is not standard compiled in on our platform
        // otherwise: condition: magic.mime_type() == /^image/
        // $jpg = { 4A 46 49 46 00 01 }
        */
        $php = "<?php"
    condition: ($jpg at 0) and $php
}
YARA Detection Rule: md5_c647e85ad77fd9971ba709a08566935d
Repository: Yara-Rules/rules

Pattern signatures:
$ = "fopen(\"cache.php\", \"w+\")"

Detection condition:
any of them

Full rule:
rule md5_c647e85ad77fd9971ba709a08566935d {
    strings: $ = "fopen(\"cache.php\", \"w+\")"
    condition: any of them
}
YARA Detection Rule: md5_fb9e35bf367a106d18eb6aa0fe406437
Repository: Yara-Rules/rules

Pattern signatures:
$ = "0B6KVua7D2SLCNDN2RW1ORmhZRWs/sp_tilang.js"

Detection condition:
any of them

Full rule:
rule md5_fb9e35bf367a106d18eb6aa0fe406437 {
    strings: $ = "0B6KVua7D2SLCNDN2RW1ORmhZRWs/sp_tilang.js"
    condition: any of them
}
YARA Detection Rule: md5_8e5f7f6523891a5dcefcbb1a79e5bbe9
Repository: Yara-Rules/rules

Pattern signatures:
$ = "if(@copy($_FILES['file']['tmp_name'],$_FILES['file']['name'])) {echo '<b>up!!!</b><br><br>';}}"

Detection condition:
any of them

Full rule:
rule md5_8e5f7f6523891a5dcefcbb1a79e5bbe9 {
    strings: $ = "if(@copy($_FILES['file']['tmp_name'],$_FILES['file']['name'])) {echo '<b>up!!!</b><br><br>';}}"
    condition: any of them
}
YARA Detection Rule: indoexploit_autoexploiter
Repository: Yara-Rules/rules

Pattern signatures:
$ = "echo \"IndoXploit - Auto Xploiter\""

Detection condition:
any of them

Full rule:
rule indoexploit_autoexploiter {
    strings: $ = "echo \"IndoXploit - Auto Xploiter\""
    condition: any of them
}
YARA Detection Rule: eval_base64_decode_a
Repository: Yara-Rules/rules

Pattern signatures:
$ = "eval(base64_decode($a));"

Detection condition:
any of them

Full rule:
rule eval_base64_decode_a {
    strings: $ = "eval(base64_decode($a));"
    condition: any of them
}
YARA Detection Rule: obfuscated_eval
Repository: Yara-Rules/rules

Pattern signatures:
$ = /\\x65\s*\\x76\s*\\x61\s*\\x6C/
	$ = "\"/.*/e\""

Detection condition:
any of them

Full rule:
rule obfuscated_eval {
    strings: 
	$ = /\\x65\s*\\x76\s*\\x61\s*\\x6C/
	$ = "\"/.*/e\""
    condition: any of them
}
YARA Detection Rule: md5_50be694a82a8653fa8b31d049aac721a
Repository: Yara-Rules/rules

Pattern signatures:
$ = "(preg_match('/\\/admin\\/Cms_Wysiwyg\\/directive\\/index\\//', $_SERVER['REQUEST_URI']))"

Detection condition:
any of them

Full rule:
rule md5_50be694a82a8653fa8b31d049aac721a {
    strings: $ = "(preg_match('/\\/admin\\/Cms_Wysiwyg\\/directive\\/index\\//', $_SERVER['REQUEST_URI']))"
    condition: any of them
}
YARA Detection Rule: md5_ab63230ee24a988a4a9245c2456e4874
Repository: Yara-Rules/rules

Pattern signatures:
$ = "eval(gzinflate(base64_decode(str_rot13(strrev("

Detection condition:
any of them

Full rule:
rule md5_ab63230ee24a988a4a9245c2456e4874 {
    strings: $ = "eval(gzinflate(base64_decode(str_rot13(strrev("
    condition: any of them
}
YARA Detection Rule: md5_b579bff90970ec58862ea8c26014d643
Repository: Yara-Rules/rules

Pattern signatures:
$ = /<Files [^>]+.(jpg|png|gif)>\s*ForceType application\/x-httpd-php/

Detection condition:
any of them

Full rule:
rule md5_b579bff90970ec58862ea8c26014d643 {
    /* forces php execution of image files, dropped in an .htaccess file under media */
    strings: $ = /<Files [^>]+.(jpg|png|gif)>\s*ForceType application\/x-httpd-php/
    condition: any of them
}
YARA Detection Rule: md5_d30b23d[PII_REDACTED]d18e90c218d7c8b
Repository: Yara-Rules/rules

Pattern signatures:
$ = "attribute_code=0x[PII_REDACTED]6f72645f68617368"

Detection condition:
any of them

Full rule:
rule md5_d30b23d[PII_REDACTED]d18e90c218d7c8b {
    strings: $ = "attribute_code=0x[PII_REDACTED]6f72645f68617368"
    condition: any of them
}
YARA Detection Rule: md5_24f2df1b9d49cfb02d8954b08dba471f
Repository: Yara-Rules/rules

Pattern signatures:
$ = "))unlink('../media/catalog/category/'.basename($"

Detection condition:
any of them

Full rule:
rule md5_24f2df1b9d49cfb02d8954b08dba471f {
    strings: $ = "))unlink('../media/catalog/category/'.basename($"
    condition: any of them
}
YARA Detection Rule: base64_hidden_in_image
Repository: Yara-Rules/rules

Pattern signatures:
$ = /JPEG-1\.1[a-zA-Z0-9\-\/]{32}/

Detection condition:
any of them

Full rule:
rule base64_hidden_in_image {
    strings: $ = /JPEG-1\.1[a-zA-Z0-9\-\/]{32}/
    condition: any of them
}
YARA Detection Rule: hide_data_in_jpeg
Repository: Yara-Rules/rules

Pattern signatures:
$ = /file_put_contents\(\$.{2,3},'JPEG-1\.1'\.base64_encode/

Detection condition:
any of them

Full rule:
rule hide_data_in_jpeg {
    strings: $ = /file_put_contents\(\$.{2,3},'JPEG-1\.1'\.base64_encode/
    condition: any of them
}
YARA Detection Rule: hidden_file_upload_in_503
Repository: Yara-Rules/rules

Pattern signatures:
$ = /error_reporting\(0\);\$f=\$_FILES\[\w+\];copy\(\$f\[tmp_name\],\$f\[name\]\);error_reporting\(E_ALL\);/

Detection condition:
any of them

Full rule:
rule hidden_file_upload_in_503 {
    strings: $ = /error_reporting\(0\);\$f=\$_FILES\[\w+\];copy\(\$f\[tmp_name\],\$f\[name\]\);error_reporting\(E_ALL\);/
    condition: any of them
}
YARA Detection Rule: md5_fd141197c89d27b30821f3de8627ac38
Repository: Yara-Rules/rules

Pattern signatures:
$ = "if(isset($_GET['do'])){$g0='adminhtml/default/default/images'"

Detection condition:
any of them

Full rule:
rule md5_fd141197c89d27b30821f3de8627ac38 {
    strings: $ = "if(isset($_GET['do'])){$g0='adminhtml/default/default/images'"
    condition: any of them
}
YARA Detection Rule: visbot
Repository: Yara-Rules/rules

Pattern signatures:
$ = "stripos($buf, 'Visbot')!==false && stripos($buf, 'Pong')!==false"
		$ = "stripos($buf, 'Visbot') !== false && stripos($buf, 'Pong')"

Detection condition:
any of them

Full rule:
rule visbot {
    strings:
		$ = "stripos($buf, 'Visbot')!==false && stripos($buf, 'Pong')!==false"
		$ = "stripos($buf, 'Visbot') !== false && stripos($buf, 'Pong')"
    condition: any of them
}
YARA Detection Rule: md5_39ca2651740c2cef91eb[PII_REDACTED]8b
Repository: Yara-Rules/rules

Pattern signatures:
$ = /if\(md5\(@\$_COOKIE\[..\]\)=='.{32}'\) \(\$_=@\$_REQUEST\[.\]\).@\$_\(\$_REQUEST\[.\]\);/

Detection condition:
any of them

Full rule:
rule md5_39ca2651740c2cef91eb[PII_REDACTED]8b {
    strings: $ = /if\(md5\(@\$_COOKIE\[..\]\)=='.{32}'\) \(\$_=@\$_REQUEST\[.\]\).@\$_\(\$_REQUEST\[.\]\);/
    condition: any of them
}
YARA Detection Rule: md5_4c4b3d4ba5bce7191a5138efa2468679
Repository: Yara-Rules/rules

Pattern signatures:
$ = "<?PHP /*** Magento** NOTICE OF LICENSE** This source file is subject to the Open Software License (OSL 3.0)* that is bundled with this package in the file LICENSE.txt.* It is also available through the world-wide-web at this URL:* http://opensource.org/licenses/osl-3.0.php**/$"
        $ = "$_SERVER['HTTP_USER_AGENT'] == 'Visbot/2.0 (+http://www.visvo.com/en/webmasters.jsp;bot@visvo.com)'"

Detection condition:
any of them

Full rule:
rule md5_4c4b3d4ba5bce7191a5138efa2468679 {
    strings:
        $ = "<?PHP /*** Magento** NOTICE OF LICENSE** This source file is subject to the Open Software License (OSL 3.0)* that is bundled with this package in the file LICENSE.txt.* It is also available through the world-wide-web at this URL:* http://opensource.org/licenses/osl-3.0.php**/$"
        $ = "$_SERVER['HTTP_USER_AGENT'] == 'Visbot/2.0 (+http://www.visvo.com/en/webmasters.jsp;bot@visvo.com)'"
    condition: any of them
}
YARA Detection Rule: md5_6eb201737a6ef3c4880ae0b8983398a9
Repository: Yara-Rules/rules

Pattern signatures:
$ = "if(md5(@$_COOKIE[qz])=="
        $ = "($_=@$_REQUEST[q]).@$_($_REQUEST[z]);"

Detection condition:
all of them

Full rule:
rule md5_6eb201737a6ef3c4880ae0b8983398a9 {
    strings:
        $ = "if(md5(@$_COOKIE[qz])=="
        $ = "($_=@$_REQUEST[q]).@$_($_REQUEST[z]);"
    condition: all of them
}
YARA Detection Rule: md5_d201d61510f7889f1a47257d52b15fa2
Repository: Yara-Rules/rules

Pattern signatures:
$ = "@eval(stripslashes($_REQUEST[q]));"

Detection condition:
any of them

Full rule:
rule md5_d201d61510f7889f1a47257d52b15fa2 {
    strings: $ = "@eval(stripslashes($_REQUEST[q]));"
    condition: any of them
}
YARA Detection Rule: md5_06e3ed58854daeacf1ed82c56a883b04
Repository: Yara-Rules/rules

Pattern signatures:
$ = "$log_entry = serialize($ARINFO)"

Detection condition:
any of them

Full rule:
rule md5_06e3ed58854daeacf1ed82c56a883b04 {
    strings: $ = "$log_entry = serialize($ARINFO)"
    condition: any of them
}
YARA Detection Rule: md5_28690a72362e021f65bb74eecc54255e
Repository: Yara-Rules/rules

Pattern signatures:
$ = "curl_setopt($ch, CURLOPT_POSTFIELDS,http_build_query(array('data'=>$data,'utmp'=>$id)));"

Detection condition:
any of them

Full rule:
rule md5_28690a72362e021f65bb74eecc54255e {
    strings: $ = "curl_setopt($ch, CURLOPT_POSTFIELDS,http_build_query(array('data'=>$data,'utmp'=>$id)));"
    condition: any of them
}
YARA Detection Rule: overwrite_globals_hack
Repository: Yara-Rules/rules

Pattern signatures:
$ = /\$GLOBALS\['[^']{,20}'\]=Array\(/

Detection condition:
any of them

Full rule:
rule overwrite_globals_hack {
    strings: $ = /\$GLOBALS\['[^']{,20}'\]=Array\(/
    condition: any of them
}
YARA Detection Rule: md5_4adef02197f50b9cc6918aa06132b2f6
Repository: Yara-Rules/rules

Pattern signatures:
$ = /\{\s*eval\s*\(\s*\$.{1,5}\s*\(\$\{\s*\$.{1,5}\s*\}\[\s*'.{1,10}'\s*\]\s*\)\s*\);\}/

Detection condition:
any of them

Full rule:
rule md5_4adef02197f50b9cc6918aa06132b2f6 {
    /* { eval($cco37(${ $kasd1}[ 'n46b398' ] ) );} */
    strings: $ = /\{\s*eval\s*\(\s*\$.{1,5}\s*\(\$\{\s*\$.{1,5}\s*\}\[\s*'.{1,10}'\s*\]\s*\)\s*\);\}/
    condition: any of them
}
YARA Detection Rule: obfuscated_globals
Repository: Yara-Rules/rules

Pattern signatures:
$ = /\$GLOBALS\['.{1,10}'\] = "\\x/

Detection condition:
any of them

Full rule:
rule obfuscated_globals {
    /* $GLOBALS['y63581'] = "\x43 */
    strings: $ = /\$GLOBALS\['.{1,10}'\] = "\\x/
    condition: any of them
}
YARA Detection Rule: ld_preload_backdoor
Repository: Yara-Rules/rules

Pattern signatures:
$ = "killall -9 \".basename(\"/usr/bin/host"

Detection condition:
any of them

Full rule:
rule ld_preload_backdoor {
    strings: $ = "killall -9 \".basename(\"/usr/bin/host"
    condition: any of them
}
YARA Detection Rule: fake_magentoupdate_site
Repository: Yara-Rules/rules

Pattern signatures:
$ = "magentopatchupdate.com"

Detection condition:
any of them

Full rule:
rule fake_magentoupdate_site {
    strings: $ = "magentopatchupdate.com"
    condition: any of them
}
YARA Detection Rule: md5_b3ee7ea209d2ff0d920dfb870bad8ce5
Repository: Yara-Rules/rules

Pattern signatures:
$ = /\$mysql_key\s*=\s*@?base64_decode/
        $ = /eval\(\s*\$mysql_key\s*\)/

Detection condition:
all of them

Full rule:
rule md5_b3ee7ea209d2ff0d920dfb870bad8ce5 {
    strings:
        $ = /\$mysql_key\s*=\s*@?base64_decode/
        $ = /eval\(\s*\$mysql_key\s*\)/
    condition: all of them
}
YARA Detection Rule: md5_e03b5df1fa070675da8b6340ff4a67c2
Repository: Yara-Rules/rules

Pattern signatures:
$ = /if\(preg_match\("\/onepage\|admin\/",\s*\$_SERVER\['REQUEST_URI'\]\)\)\{\s*@?file_put_contents/
        $ = /@?base64_encode\(serialize\(\$_REQUEST\)\."--"\.serialize\(\$_COOKIE\)\)\."\\n",\s*FILE_APPEND\)/

Detection condition:
any of them

Full rule:
rule md5_e03b5df1fa070675da8b6340ff4a67c2 {
    strings:
        $ = /if\(preg_match\("\/onepage\|admin\/",\s*\$_SERVER\['REQUEST_URI'\]\)\)\{\s*@?file_put_contents/
        $ = /@?base64_encode\(serialize\(\$_REQUEST\)\."--"\.serialize\(\$_COOKIE\)\)\."\\n",\s*FILE_APPEND\)/
    condition: any of them
}
YARA Detection Rule: md5_023a80d10d10d911989e115b477e42b5
Repository: Yara-Rules/rules

Pattern signatures:
$ = /chr\(\d{,3}\)\.\"\"\.chr\(\d{,3}\)/

Detection condition:
any of them

Full rule:
rule md5_023a80d10d10d911989e115b477e42b5 {
    strings: $ = /chr\(\d{,3}\)\.\"\"\.chr\(\d{,3}\)/
    condition: any of them
}
YARA Detection Rule: md5_4aa900ddd4f1848a15c61a9b7acd5035
Repository: Yara-Rules/rules

Pattern signatures:
$ = "'base'.(128/2).'_de'.'code'"

Detection condition:
any of them

Full rule:
rule md5_4aa900ddd4f1848a15c61a9b7acd5035 {
    strings: $ = "'base'.(128/2).'_de'.'code'"
    condition: any of them
}
YARA Detection Rule: md5_f797dd5d8e13fe5c8898dbe3beb3cc5b
Repository: Yara-Rules/rules

Pattern signatures:
$ = "echo(\"FILE_Bad\");"

Detection condition:
any of them

Full rule:
rule md5_f797dd5d8e13fe5c8898dbe3beb3cc5b {
    strings: $ = "echo(\"FILE_Bad\");"
    condition: any of them
}
YARA Detection Rule: urausy_skype_dat
Repository: Yara-Rules/rules
Detects: Yara rule to match against memory of processes infected by Urausy skype.dat
Author: AlienVault Labs

Pattern signatures:
$a = "skype.dat" ascii wide
		$b = "skype.ini" ascii wide
		$win1 = "CreateWindow"
		$win2 = "YIWEFHIWQ" ascii wide
		$desk1 = "CreateDesktop"
		$desk2 = "MyDesktop" ascii wide

Detection condition:
$a and $b and (all of ($win*) or all of ($desk*))

Full rule:
rule urausy_skype_dat : memory {
	meta:
		author = "AlienVault Labs"
		description = "Yara rule to match against memory of processes infected by Urausy skype.dat"
	strings:
		$a = "skype.dat" ascii wide
		$b = "skype.ini" ascii wide
		$win1 = "CreateWindow"
		$win2 = "YIWEFHIWQ" ascii wide
		$desk1 = "CreateDesktop"
		$desk2 = "MyDesktop" ascii wide
	condition:
		$a and $b and (all of ($win*) or all of ($desk*))
}
YARA Detection Rule: WindowsCredentialEditor
Repository: Yara-Rules/rules
Detects: Windows Credential Editor

Pattern signatures:
$a = "extract the TGT session key"
		$b = "Windows Credentials Editor"

Detection condition:
$a or $b

Full rule:
rule WindowsCredentialEditor
{
    meta:
    	description = "Windows Credential Editor" threat_level = 10 score = 90
    strings:
		$a = "extract the TGT session key"
		$b = "Windows Credentials Editor"
    condition:
    	$a or $b
}
YARA Detection Rule: Amplia_Security_Tool
Repository: Yara-Rules/rules
Detects: Amplia Security Tool

Pattern signatures:
$a = "Amplia Security"
		$b = "Hernan Ochoa"
		$c = "getlsasrvaddr.exe"
		$d = "Cannot get PID of LSASS.EXE"
		$e = "extract the TGT session key"
		$f = "PPWDUMP_DATA"

Detection condition:
1 of them

Full rule:
rule Amplia_Security_Tool
{
    meta:
		description = "Amplia Security Tool"
		score = 60
		nodeepdive = 1
    strings:
		$a = "Amplia Security"
		$b = "Hernan Ochoa"
		$c = "getlsasrvaddr.exe"
		$d = "Cannot get PID of LSASS.EXE"
		$e = "extract the TGT session key"
		$f = "PPWDUMP_DATA"
    condition: 1 of them
}
YARA Detection Rule: PwDump
Repository: Yara-Rules/rules
Detects: PwDump 6 variant
Author: Marc Stroebel

Pattern signatures:
$s5 = "Usage: %s [-x][-n][-h][-o output_file][-u user][-p password][-s share] machineNa"
		$s6 = "Unable to query service status. Something is wrong, please manually check the st"
		$s7 = "pwdump6 Version %s by fizzgig and the mighty group at foofus.net" fullword

Detection condition:
all of them

Full rule:
rule PwDump
{
	meta:
		description = "PwDump 6 variant"
		author = "Marc Stroebel"
		date = "2014-04-24"
		score = 70
	strings:
		$s5 = "Usage: %s [-x][-n][-h][-o output_file][-u user][-p password][-s share] machineNa"
		$s6 = "Unable to query service status. Something is wrong, please manually check the st"
		$s7 = "pwdump6 Version %s by fizzgig and the mighty group at foofus.net" fullword
	condition:
		all of them
}
YARA Detection Rule: PScan_Portscan_1
Repository: Yara-Rules/rules
Detects: PScan - Port Scanner
Author: F. Roth

Pattern signatures:
$a = "00050;0F0M0X0a0v0}0"
		$b = "vwgvwgvP76"
		$c = "Pr0PhOFyP"

Detection condition:
all of them

Full rule:
rule PScan_Portscan_1 {
	meta:
		description = "PScan - Port Scanner"
		author = "F. Roth"
		score = 50
	strings:
		$a = "00050;0F0M0X0a0v0}0"
		$b = "vwgvwgvP76"
		$c = "Pr0PhOFyP"
	condition:
		all of them
}
YARA Detection Rule: HackTool_Samples
Repository: Yara-Rules/rules
Detects: Hacktool

Pattern signatures:
$a = "Unable to uninstall the fgexec service"
		$b = "Unable to set socket to sniff"
		$c = "Failed to load SAM functions"
		$d = "Dump system passwords"
		$e = "Error opening sam hive or not valid file"
		$f = "Couldn't find LSASS pid"
		$g = "samdump.dll"
		$h = "WPEPRO SEND PACKET"
		$i = "WPE-C1467211-7C89-49c5-801A-1D048E4014C4"
		$j = "Usage: unshadow PASSWORD-FILE SHADOW-FILE"
		$k = "arpspoof\\Debug"
		$l = "Success: The log has been cleared"
		$m = "clearlogs [\\\\computername"
		$n = "DumpUsers 1."
		$o = "dictionary attack with specified dictionary file"
		$p = "by Objectif Securite"
		$q = "objectif-securite"
		$r = "Cannot query LSA Secret on remote host"
		$s = "Cannot write to process memory on remote host"
		$t = "Cannot start PWDumpX service on host"
		$u = "usage: %s <system hive> <security hive>"
		$v = "username:domainname:LMhash:NThash"
		$w = "<server_name_or_ip> | -f <server_list_file> [username] [password]"
		$x = "Impersonation Tokens Available"
		$y = "failed 

Detection condition:
1 of them

Full rule:
rule HackTool_Samples {
	meta:
		description = "Hacktool"
		score = 50
	strings:
		$a = "Unable to uninstall the fgexec service"
		$b = "Unable to set socket to sniff"
		$c = "Failed to load SAM functions"
		$d = "Dump system passwords"
		$e = "Error opening sam hive or not valid file"
		$f = "Couldn't find LSASS pid"
		$g = "samdump.dll"
		$h = "WPEPRO SEND PACKET"
		$i = "WPE-C1467211-7C89-49c5-801A-1D048E4014C4"
		$j = "Usage: unshadow PASSWORD-FILE SHADOW-FILE"
		$k = "arpspoof\\Debug"
		$l = "Success: The log has been cleared"
		$m = "clearlogs [\\\\computername"
		$n = "DumpUsers 1."
		$o = "dictionary attack with specified dictionary file"
		$p = "by Objectif Securite"
		$q = "objectif-securite"
		$r = "Cannot query LSA Secret on remote host"
		$s = "Cannot write to process memory on remote host"
		$t = "Cannot start PWDumpX service on host"
		$u = "usage: %s <system hive> <security hive>"
		$v = "username:domainname:LMhash:NThash"
		$w = "<server_name_or_ip> | -f <server_list_file> [username] [password]"
		$x = "Impersonation Tokens Available"
		$y = "failed to parse pwdump format string"
		$z = "Dumping password"
	condition:
		1 of them
}
YARA Detection Rule: Fierce2
Repository: Yara-Rules/rules
Detects: This signature detects the Fierce2 domain scanner
Author: Florian Roth

Pattern signatures:
$s1 = "$tt_xml->process( 'end_domainscan.tt', $end_domainscan_vars,"

Detection condition:
1 of them

Full rule:
rule Fierce2
{
	meta:
		author = "Florian Roth"
		description = "This signature detects the Fierce2 domain scanner"
		date = "07/2014"
		score = 60
	strings:
		$s1 = "$tt_xml->process( 'end_domainscan.tt', $end_domainscan_vars,"
	condition:
		1 of them
}
YARA Detection Rule: Ncrack
Repository: Yara-Rules/rules
Detects: This signature detects the Ncrack brute force tool
Author: Florian Roth

Pattern signatures:
$s1 = "NcrackOutputTable only supports adding up to 4096 to a cell via"

Detection condition:
1 of them

Full rule:
rule Ncrack
{
	meta:
		author = "Florian Roth"
		description = "This signature detects the Ncrack brute force tool"
		date = "07/2014"
		score = 60
	strings:
		$s1 = "NcrackOutputTable only supports adding up to 4096 to a cell via"
	condition:
		1 of them
}
YARA Detection Rule: SQLMap
Repository: Yara-Rules/rules
Detects: This signature detects the SQLMap SQL injection tool
Author: Florian Roth

Pattern signatures:
$s1 = "except SqlmapBaseException, ex:"

Detection condition:
1 of them

Full rule:
rule SQLMap
{
	meta:
		author = "Florian Roth"
		description = "This signature detects the SQLMap SQL injection tool"
		date = "07/2014"
		score = 60
	strings:
		$s1 = "except SqlmapBaseException, ex:"
	condition:
		1 of them
}
YARA Detection Rule: PortScanner
Repository: Yara-Rules/rules
Detects: Auto-generated rule on file PortScanner.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s0 = "Scan Ports Every"
		$s3 = "Scan All Possible Ports!"

Detection condition:
all of them

Full rule:
rule PortScanner {
	meta:
		description = "Auto-generated rule on file PortScanner.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "b381b9212282c0c650cb4b0323436c63"
	strings:
		$s0 = "Scan Ports Every"
		$s3 = "Scan All Possible Ports!"
	condition:
		all of them
}
YARA Detection Rule: DomainScanV1_0
Repository: Yara-Rules/rules
Detects: Auto-generated rule on file DomainScanV1_0.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s0 = "dIJMuX$aO-EV"
		$s1 = "XELUxP\"-\\"
		$s2 = "KaR\"U'}-M,."
		$s3 = "V.)\\ZDxpLSav"
		$s4 = "Decompress error"
		$s5 = "Can't load library"
		$s6 = "Can't load function"
		$s7 = "com0tl32:.d"

Detection condition:
all of them

Full rule:
rule DomainScanV1_0 {
	meta:
		description = "Auto-generated rule on file DomainScanV1_0.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "aefcd73b802e1c2bdc9b2ef206a4f24e"
	strings:
		$s0 = "dIJMuX$aO-EV"
		$s1 = "XELUxP\"-\\"
		$s2 = "KaR\"U'}-M,."
		$s3 = "V.)\\ZDxpLSav"
		$s4 = "Decompress error"
		$s5 = "Can't load library"
		$s6 = "Can't load function"
		$s7 = "com0tl32:.d"
	condition:
		all of them
}
YARA Detection Rule: MooreR_Port_Scanner
Repository: Yara-Rules/rules
Detects: Auto-generated rule on file MooreR Port Scanner.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s0 = "Description|"
		$s3 = "soft Visual Studio\\VB9yp"
		$s4 = "adj_fptan?4"
		$s7 = "DOWS\\SyMem32\\/o"

Detection condition:
all of them

Full rule:
rule MooreR_Port_Scanner {
	meta:
		description = "Auto-generated rule on file MooreR Port Scanner.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "376304acdd0b0251c8b19fea20bb6f5b"
	strings:
		$s0 = "Description|"
		$s3 = "soft Visual Studio\\VB9yp"
		$s4 = "adj_fptan?4"
		$s7 = "DOWS\\SyMem32\\/o"
	condition:
		all of them
}