deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: REDLEAVES_CoreImplant_UniqueStrings
Repository: Neo23x0/signature-base
Detects: Strings identifying the core REDLEAVES RAT in its deobfuscated state
Author: USG
Reference: https://www.us-cert.gov/ncas/alerts/TA17-117A

Pattern signatures:
$unique2 = "RedLeavesSCMDSimulatorMutex" nocase wide ascii
        $unique4 = "red_autumnal_leaves_dllmain.dll" wide ascii
        $unique7 = "\\NamePipe_MoreWindows" wide ascii

Detection condition:
not uint32(0) == 0x66676572 // not regf (registry hives)
        and any of them

Full rule:
rule REDLEAVES_CoreImplant_UniqueStrings {
    meta:
        description = "Strings identifying the core REDLEAVES RAT in its deobfuscated state"
        reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
        author = "USG"
        date = "2018-12-20"
        modified = "2024-04-17"
        id = "fd4d4804-f7d9-549d-8f63-5f409d6180f9"
    strings:
        $unique2 = "RedLeavesSCMDSimulatorMutex" nocase wide ascii
        $unique4 = "red_autumnal_leaves_dllmain.dll" wide ascii
        $unique7 = "\\NamePipe_MoreWindows" wide ascii
    condition:
        not uint32(0) == 0x66676572 // not regf (registry hives)
        and any of them
}
YARA Detection Rule: PLUGX_RedLeaves
Repository: Neo23x0/signature-base
Detects: Detects specific RedLeaves and PlugX binaries
Author: US-CERT Code Analysis Team
Reference: https://www.us-cert.gov/ncas/alerts/TA17-117A

Pattern signatures:
$s0 = {[PII_REDACTED]3D2FD0010072F433C08BFF[PII_REDACTED]3D2FD0010072F4 }
        $s1 = "C:\\Users\\user\\Desktop\\my_OK_2014\\bit9\\runsna\\Release\\runsna.pdb"
        $s2 = "d:\\work\\plug4.0(shellcode)"
        $s3 = "\\shellcode\\shellcode\\XSetting.h"
        $s4 = { 42AFF4276A45AA58474D4C4BE03D5B395566BEBCBDEDE9972872C5C4C5498228 }
        $s5 = { 8AD32AD002D180C23830140E413BCB7CEF6A006A006A00566A006A00 }
        $s6 = { EB055F8BC7EB05E8F6FFFFFF558BEC81ECC[PII_REDACTED]657 }
        $s7 = { 8A043233C932043983C[PII_REDACTED]F90A7CF242890D18AA00103BD37CE2891514AA00106A006A006A0056 }
        $s8 = { 293537675A402A333557B05E04D09CB05EB3ADA4A4A40ED0B7DAB7935F5B5B08 }
        $s9 = "RedLeavesCMDSimulatorMutex"

Detection condition:
$s0 or $s1 or $s2 and $s3 or $s4 or $s5 or $s6 or $s7 or $s8 or $s9

Full rule:
rule PLUGX_RedLeaves {
    meta:
        author = "US-CERT Code Analysis Team"
        date = "03.04.2017"
        reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
        incident = "10118538"
        date = "2017-04-03"
        MD5_1 = "598FF82EA4FB52717ACAFB227C83D474"
        MD5_2 = "7D10708A518B26CC8C3CBFBAA224E032"
        MD5_3 = "AF406D35C77B1E0DF17F839E36BCE630"
        MD5_4 = "6EB9E889B091A5647F6095DCD4DE7C83"
        MD5_5 = "566291B277534B63EAFC938CDAAB8A399E41AF7D"
        description = "Detects specific RedLeaves and PlugX binaries"
        id = "ede8ad8f-31cf-5314-9777-bddd60e499f2"
    strings:
        $s0 = {[PII_REDACTED]3D2FD0010072F433C08BFF[PII_REDACTED]3D2FD0010072F4 }
        $s1 = "C:\\Users\\user\\Desktop\\my_OK_2014\\bit9\\runsna\\Release\\runsna.pdb"
        $s2 = "d:\\work\\plug4.0(shellcode)"
        $s3 = "\\shellcode\\shellcode\\XSetting.h"
        $s4 = { 42AFF4276A45AA58474D4C4BE03D5B395566BEBCBDEDE9972872C5C4C5498228 }
        $s5 = { 8AD32AD002D180C23830140E413BCB7CEF6A006A006A00566A006A00 }
        $s6 = { EB055F8BC7EB05E8F6FFFFFF558BEC81ECC[PII_REDACTED]657 }
        $s7 = { 8A043233C932043983C[PII_REDACTED]F90A7CF242890D18AA00103BD37CE2891514AA00106A006A006A0056 }
        $s8 = { 293537675A402A333557B05E04D09CB05EB3ADA4A4A40ED0B7DAB7935F5B5B08 }
        $s9 = "RedLeavesCMDSimulatorMutex"
    condition:
        $s0 or $s1 or $s2 and $s3 or $s4 or $s5 or $s6 or $s7 or $s8 or $s9
}
YARA Detection Rule: POSHSPY_Malware
Repository: Neo23x0/signature-base
Detects: Detects
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html

Pattern signatures:
$x1 = "function sWP($cN, $pN, $aK, $aI)" fullword ascii
      $x2 = "$aeK = [byte[]] (0x69, 0x87, 0x0b, 0xf2" ascii
      $x3 = "(('variant', 'excretions', 'accumulators', 'winslow', 'whistleable', 'len',"
      $x4 = "$cPairKey = \"BwIAAACkAABSU0EyAAQAAAEAA"
      $x5 = "$exeRes = exePldRoutine"
      $x6 = "ZgB1AG4AYwB0AGkAbwBuACAAcAB1AHIAZgBDAHIA"

Detection condition:
1 of them

Full rule:
rule POSHSPY_Malware {
   meta:
      description = "Detects"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html"
      date = "2017-07-15"
      id = "7e908efc-0023-5be1-9871-8bfbf8b9e53a"
   strings:
      $x1 = "function sWP($cN, $pN, $aK, $aI)" fullword ascii
      $x2 = "$aeK = [byte[]] (0x69, 0x87, 0x0b, 0xf2" ascii
      $x3 = "(('variant', 'excretions', 'accumulators', 'winslow', 'whistleable', 'len',"
      $x4 = "$cPairKey = \"BwIAAACkAABSU0EyAAQAAAEAA"
      $x5 = "$exeRes = exePldRoutine"
      $x6 = "ZgB1AG4AYwB0AGkAbwBuACAAcAB1AHIAZgBDAHIA"
   condition:
      1 of them
}
YARA Detection Rule: PUA_VULN_Driver_Zemanaltd_Zam_D7E0
Repository: Neo23x0/signature-base
Detects: Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0032002e[PII_REDACTED]2e0031002e[PII_REDACTED]30 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e0031002e[PII_REDACTED]30 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and all of them

Full rule:
rule PUA_VULN_Driver_Zemanaltd_Zam_D7E0 {
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "d7e091e0d478c34232e8479b950c5513077b3a69309885cee4c61063e5f74ac0"
		date = "2024-08-07"
		score = 40
		id = "62c2caf4-0f8e-5873-bc77-ea5a6b390e29"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0032002e[PII_REDACTED]2e0031002e[PII_REDACTED]30 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e0031002e[PII_REDACTED]30 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and all of them
}
YARA Detection Rule: PUA_VULN_Driver_Bsmisys_5962
Repository: Neo23x0/signature-base
Detects: Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BSMI.sys, BSMIXP64.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]0053004d[PII_REDACTED][PII_REDACTED][PII_REDACTED]72 } /* FileDescription SMIDriver */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0031002e0030002e0030002e0033 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0031002e0030002e0030002e0033 } /* ProductVersion  */
		$ = { 0049006e[PII_REDACTED]72006e0061006c004e0061006d0065[1-8][PII_REDACTED]4d0049002e[PII_REDACTED]73 } /* InternalName BSMIsys */
		$ = { 004f[PII_REDACTED]670069006e0061006c[PII_REDACTED]6c0065006e0061006d0065[1-8][PII_REDACTED]4d0049002e[PII_REDACTED]73 } /* OriginalFilename BSMIsys */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]0043006f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]420049004f[PII_REDACTED][PII_REDACTED]0043006f[PII_REDACTED]2e[PII_REDACTED][PII_REDACTED] } /* LegalCopyright CopyrightCBIOSTARCorp */

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and all of them

Full rule:
rule PUA_VULN_Driver_Bsmisys_5962 {
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BSMI.sys, BSMIXP64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347"
		hash = "552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9"
		date = "2024-08-07"
		score = 40
		id = "86a0715c-4f0b-52ba-b6dc-44bd4499a222"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]0053004d[PII_REDACTED][PII_REDACTED][PII_REDACTED]72 } /* FileDescription SMIDriver */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0031002e0030002e0030002e0033 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0031002e0030002e0030002e0033 } /* ProductVersion  */
		$ = { 0049006e[PII_REDACTED]72006e0061006c004e0061006d0065[1-8][PII_REDACTED]4d0049002e[PII_REDACTED]73 } /* InternalName BSMIsys */
		$ = { 004f[PII_REDACTED]670069006e0061006c[PII_REDACTED]6c0065006e0061006d0065[1-8][PII_REDACTED]4d0049002e[PII_REDACTED]73 } /* OriginalFilename BSMIsys */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]0043006f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]420049004f[PII_REDACTED][PII_REDACTED]0043006f[PII_REDACTED]2e[PII_REDACTED][PII_REDACTED] } /* LegalCopyright CopyrightCBIOSTARCorp */
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and all of them
}
YARA Detection Rule: PUA_VULN_Driver_Zemanaltd_Zam_8FE9
Repository: Neo23x0/signature-base
Detects: Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e[PII_REDACTED]35 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and all of them

Full rule:
rule PUA_VULN_Driver_Zemanaltd_Zam_8FE9 {
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "8fe9828bea83adc8b1429394db7a556a17f79846ad0bfb7f242084a5c96edf2a"
		date = "2024-08-07"
		score = 40
		id = "45ac5fe9-25e2-5ee9-a410-95d19ec75e33"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e[PII_REDACTED]35 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and all of them
}
YARA Detection Rule: PUA_VULN_Driver_Yyinc_Dianhu_80CB
Repository: Neo23x0/signature-base
Detects: Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Dh_Kernel_10.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8][PII_REDACTED]61006e00680075 } /* FileDescription dianhu */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8][PII_REDACTED]200049006e0063002e } /* CompanyName YYInc */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0031002e0030002e00390039 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0031002e0030002e00390039 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8][PII_REDACTED]61006e00680075 } /* ProductName dianhu */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]0043006f[PII_REDACTED][PII_REDACTED][PII_REDACTED]2000a[PII_REDACTED][PII_REDACTED]7002d[PII_REDACTED][PII_REDACTED][PII_REDACTED]200049006e0063002e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright CopyrightYYIncAllrightsreserved */

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and all of them

Full rule:
rule PUA_VULN_Driver_Yyinc_Dianhu_80CB {
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Dh_Kernel_10.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "80cbba9f404df3e642f22c476664d63d7c229d45d34f5cd0e19c65eb41becec3"
		hash = "bb50818a07b0eb1bd317467139b7eb4bad6cd89053fecdabfeae[PII_REDACTED]5"
		date = "2024-08-07"
		score = 40
		id = "166a402d-9679-54b8-9703-3e3b2b001236"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8][PII_REDACTED]61006e00680075 } /* FileDescription dianhu */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8][PII_REDACTED]200049006e0063002e } /* CompanyName YYInc */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0031002e0030002e00390039 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0031002e0030002e00390039 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8][PII_REDACTED]61006e00680075 } /* ProductName dianhu */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]0043006f[PII_REDACTED][PII_REDACTED][PII_REDACTED]2000a[PII_REDACTED][PII_REDACTED]7002d[PII_REDACTED][PII_REDACTED][PII_REDACTED]200049006e0063002e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright CopyrightYYIncAllrightsreserved */
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and all of them
}
YARA Detection Rule: PUA_VULN_Driver_3F20
Repository: Neo23x0/signature-base
Detects: Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - pchunter.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]7cfb7edf4fe1606f67e5770b5de55177 } /* FileDescription  */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]5b8982af7f5176feff0853174eacff0979d[PII_REDACTED]50516c53f8 } /* CompanyName  */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0031002e0030002e0030002e0035 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0031002e0030002e0035002e0037 } /* ProductVersion  */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8][PII_REDACTED][PII_REDACTED][PII_REDACTED]39002d[PII_REDACTED][PII_REDACTED]0041006e[PII_REDACTED]6e[PII_REDACTED][PII_REDACTED]006f[PII_REDACTED]6f[PII_REDACTED]740069006f006e002e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright CAnXinSecCorporationAllRightsReserved */

Detection condition:
uint16(0) == 0x5a4d and filesize < 700KB and all of them

Full rule:
rule PUA_VULN_Driver_3F20 {
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - pchunter.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "3f20ac5dac9171857fc[PII_REDACTED]fdb6eac4fab837d7eabc42cb0a83cb522fc"
		date = "2024-08-07"
		score = 40
		id = "ab0247c7-eb20-5481-9fed-f9608dd4cb93"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]7cfb7edf4fe1606f67e5770b5de55177 } /* FileDescription  */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]5b8982af7f5176feff0853174eacff0979d[PII_REDACTED]50516c53f8 } /* CompanyName  */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0031002e0030002e0030002e0035 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0031002e0030002e0035002e0037 } /* ProductVersion  */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8][PII_REDACTED][PII_REDACTED][PII_REDACTED]39002d[PII_REDACTED][PII_REDACTED]0041006e[PII_REDACTED]6e[PII_REDACTED][PII_REDACTED]006f[PII_REDACTED]6f[PII_REDACTED]740069006f006e002e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright CAnXinSecCorporationAllRightsReserved */
	condition:
		uint16(0) == 0x5a4d and filesize < 700KB and all of them
}
YARA Detection Rule: PUA_VULN_Driver_Dell_Dbutil_71FE
Repository: Neo23x0/signature-base
Detects: Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DBUtilDrv2.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8][PII_REDACTED][PII_REDACTED]006c } /* FileDescription DBUtil */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8][PII_REDACTED]6c006c } /* CompanyName Dell */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e0037002e0030002e0030 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8][PII_REDACTED][PII_REDACTED]006c } /* ProductName DBUtil */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]00a[PII_REDACTED][PII_REDACTED][PII_REDACTED]65006c006c[PII_REDACTED]6e0063002e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e0020 } /* LegalCopyright DellIncAllRightsReserved */

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and all of them

Full rule:
rule PUA_VULN_Driver_Dell_Dbutil_71FE {
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DBUtilDrv2.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009"
		date = "2024-08-07"
		score = 40
		id = "172e8e13-e1ff-5caf-9759-d607ef072215"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8][PII_REDACTED][PII_REDACTED]006c } /* FileDescription DBUtil */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8][PII_REDACTED]6c006c } /* CompanyName Dell */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e0037002e0030002e0030 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8][PII_REDACTED][PII_REDACTED]006c } /* ProductName DBUtil */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]00a[PII_REDACTED][PII_REDACTED][PII_REDACTED]65006c006c[PII_REDACTED]6e0063002e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e0020 } /* LegalCopyright DellIncAllRightsReserved */
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and all of them
}