deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: SUSP_LNX_Base64_Exec_Apr24
Repository: Neo23x0/signature-base
Detects: Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Author: Christian Burkard
Reference: Internal Research

Pattern signatures:
$s1 = "curl http://" base64
      $s2 = "wget http://" base64
      $s3 = ";chmod 777 " base64
      // $s4 = "/tmp/" base64 // prone to FPs
      
      $mirai = "country="

      $fp1 = "<html"
      $fp2 = "<?xml"

Detection condition:
filesize < 800KB
      and 1 of ($s*) 
      and not $mirai
      and not 1 of ($fp*)

Full rule:
rule SUSP_LNX_Base64_Exec_Apr24 : SCRIPT {
   meta:
      description = "Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)"
      author = "Christian Burkard"
      date = "2024-04-18"
      modified = "2025-03-21"
      reference = "Internal Research"
      score = 75
      id = "2da3d050-86b0-5903-97eb-c5f39ce4f3a3"
   strings:
      $s1 = "curl http://" base64
      $s2 = "wget http://" base64
      $s3 = ";chmod 777 " base64
      // $s4 = "/tmp/" base64 // prone to FPs
      
      $mirai = "country="

      $fp1 = "<html"
      $fp2 = "<?xml"
   condition:
      filesize < 800KB
      and 1 of ($s*) 
      and not $mirai
      and not 1 of ($fp*)
}
YARA Detection Rule: TA17_293A_energetic_bear_api_hashing_tool
Repository: Neo23x0/signature-base
Detects: Energetic Bear API Hashing Tool
Author: CERT RE Team

Pattern signatures:
$api_hash_func_v1 = { 8A 08 84 C9 74 ?? 80 C9 60 01 CB C1 E3 01 03 45 10 EB ED }
      $api_hash_func_v2 = { 8A 08 84 C9 74 ?? 80 C9 60 01 CB C1 E3 01 03 44 24 14 EB EC }
      $api_hash_func_x64 = { 8A 08 84 C9 74 ?? 80 C9 60 48 01 CB 48 C1 E3 01 48 03 45 20 EB EA }

      $http_push = "X-mode: push" nocase
      $http_pop = "X-mode: pop" nocase

Detection condition:
$api_hash_func_v1 or $api_hash_func_v2 or $api_hash_func_x64 and (uint16(0) == 0x5a4d or $http_push or $http_pop)

Full rule:
rule TA17_293A_energetic_bear_api_hashing_tool {
   meta:
      description = "Energetic Bear API Hashing Tool"
      assoc_report = "DHS Report TA17-293A"
      author = "CERT RE Team"
      version = "2"
      id = "4e58800a-9618-5d8b-954c-e843be6002c2"
   strings:
      $api_hash_func_v1 = { 8A 08 84 C9 74 ?? 80 C9 60 01 CB C1 E3 01 03 45 10 EB ED }
      $api_hash_func_v2 = { 8A 08 84 C9 74 ?? 80 C9 60 01 CB C1 E3 01 03 44 24 14 EB EC }
      $api_hash_func_x64 = { 8A 08 84 C9 74 ?? 80 C9 60 48 01 CB 48 C1 E3 01 48 03 45 20 EB EA }

      $http_push = "X-mode: push" nocase
      $http_pop = "X-mode: pop" nocase
   condition:
      $api_hash_func_v1 or $api_hash_func_v2 or $api_hash_func_x64 and (uint16(0) == 0x5a4d or $http_push or $http_pop)
}
YARA Detection Rule: TA17_293A_Query_XML_Code_MAL_DOC_PT_2
Repository: Neo23x0/signature-base
Author: other (modified by Florian Roth)
Reference: https://www.us-cert.gov/ncas/alerts/TA17-293A

Pattern signatures:
$dir1 = "word/_rels/settings.xml.rels"
        $bytes = {8c 90 cd 4e eb 30 10 85 d7}

Detection condition:
uint32(0) == 0x04034b50 and $dir1 and $bytes

Full rule:
rule TA17_293A_Query_XML_Code_MAL_DOC_PT_2 {
    meta:
        name= "Query_XML_Code_MAL_DOC_PT_2"
        author = "other (modified by Florian Roth)"
        reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
        id = "82b0f28a-94b6-52ab-8fd6-cdc05823ac34"
    strings:
        $dir1 = "word/_rels/settings.xml.rels"
        $bytes = {8c 90 cd 4e eb 30 10 85 d7}
    condition:
        uint32(0) == 0x04034b50 and $dir1 and $bytes
}
YARA Detection Rule: TA17_293A_Query_XML_Code_MAL_DOC
Repository: Neo23x0/signature-base
Author: other (modified by Florian Roth)
Reference: https://www.us-cert.gov/ncas/alerts/TA17-293A

Pattern signatures:
$dir = "word/_rels/" ascii
        $dir2 = "word/theme/theme1.xml" ascii
        $style = "word/styles.xml" ascii

Detection condition:
uint32(0) == 0x04034b50 and $dir at 0x0145 and $dir2 at 0x02b7 and $style at 0x08fd

Full rule:
rule TA17_293A_Query_XML_Code_MAL_DOC {
    meta:
        name= "Query_XML_Code_MAL_DOC"
        author = "other (modified by Florian Roth)"
        reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
        id = "82b0f28a-94b6-52ab-8fd6-cdc05823ac34"
    strings:
        $dir = "word/_rels/" ascii
        $dir2 = "word/theme/theme1.xml" ascii
        $style = "word/styles.xml" ascii
    condition:
        uint32(0) == 0x04034b50 and $dir at 0x0145 and $dir2 at 0x02b7 and $style at 0x08fd
}
YARA Detection Rule: TA17_293A_Query_Javascript_Decode_Function
Repository: Neo23x0/signature-base
Author: other (modified by Florian Roth)
Reference: https://www.us-cert.gov/ncas/alerts/TA17-293A

Pattern signatures:
$decode1 = {72 65 70 6C 61 63 65 28 2F 5B 5E 41 2D 5A 61 2D 7A 30 2D 39 5C 2B 5C 2F 5C 3D 5D 2F 67 2C 22 22 29 3B}
        $decode2 = {22 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 59 5A 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F 70 71 72 73 74 75 76 77 78 79 7A 30 31 32 33 34 35 36 37 38 39 2B 2F 3D 22 2E 69 6E 64 65 78 4F 66 28 ?? 2E 63 68 61 72 41 74 28 ?? 2B 2B 29 29}
        $decode3 = {3D ?? 3C 3C 32 7C ?? 3E 3E 34 2C ?? 3D 28 ?? 26 31 35 29 3C 3C 34 7C ?? 3E 3E 32 2C ?? 3D 28 ?? 26 33 29 3C 3C 36 7C ?? 2C ?? 2B 3D [1-2] 53 74 72 69 6E 67 2E 66 72 6F 6D 43 68 61 72 43 6F 64 65 28 ?? 29 2C 36 34 21 3D ?? 26 26 28 ?? 2B 3D 53 74 72 69 6E 67 2E 66 72 6F 6D 43 68 61 72 43 6F 64 65 28 ?? 29}
        $decode4 = {73 75 62 73 74 72 69 6E 67 28 34 2C ?? 2E 6C 65 6E 67 74 68 29}
        /* Only 3 characters atom - this is bad for performance - we're trying to leave this out
        $func_call="a(\""
        */

Detection condition:
filesize < 20KB and
        /* #func_call > 20 and */
        all of ($decode*)

Full rule:
rule TA17_293A_Query_Javascript_Decode_Function {
    meta:
        name= "Query_Javascript_Decode_Function"
        author = "other (modified by Florian Roth)"
        reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
        id = "bc206ab3-a86b-5abe-ae84-15abab838d4e"
    strings:
        $decode1 = {72 65 70 6C 61 63 65 28 2F 5B 5E 41 2D 5A 61 2D 7A 30 2D 39 5C 2B 5C 2F 5C 3D 5D 2F 67 2C 22 22 29 3B}
        $decode2 = {22 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 59 5A 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F 70 71 72 73 74 75 76 77 78 79 7A 30 31 32 33 34 35 36 37 38 39 2B 2F 3D 22 2E 69 6E 64 65 78 4F 66 28 ?? 2E 63 68 61 72 41 74 28 ?? 2B 2B 29 29}
        $decode3 = {3D ?? 3C 3C 32 7C ?? 3E 3E 34 2C ?? 3D 28 ?? 26 31 35 29 3C 3C 34 7C ?? 3E 3E 32 2C ?? 3D 28 ?? 26 33 29 3C 3C 36 7C ?? 2C ?? 2B 3D [1-2] 53 74 72 69 6E 67 2E 66 72 6F 6D 43 68 61 72 43 6F 64 65 28 ?? 29 2C 36 34 21 3D ?? 26 26 28 ?? 2B 3D 53 74 72 69 6E 67 2E 66 72 6F 6D 43 68 61 72 43 6F 64 65 28 ?? 29}
        $decode4 = {73 75 62 73 74 72 69 6E 67 28 34 2C ?? 2E 6C 65 6E 67 74 68 29}
        /* Only 3 characters atom - this is bad for performance - we're trying to leave this out
        $func_call="a(\""
        */
    condition:
        filesize < 20KB and
        /* #func_call > 20 and */
        all of ($decode*)
}
YARA Detection Rule: TA17_293A_Hacktool_PS_1
Repository: Neo23x0/signature-base
Detects: Auto-generated rule
Author: Florian Roth (Nextron Systems)
Reference: https://www.us-cert.gov/ncas/alerts/TA17-293A

Pattern signatures:
$x1 = "$HashFormat = '$krb5tgs$23$*ID#124_DISTINGUISHED NAME: CN=fakesvc,OU=Service,OU=Accounts,OU=EnterpriseObjects,DC=asdf,DC=pd,DC=f" ascii
      $x2 = "} | Where-Object {$_.SamAccountName -notmatch 'krbtgt'} | Get-SPNTicket @GetSPNTicketArguments" fullword ascii

Detection condition:
( filesize < 80KB and 1 of them )

Full rule:
rule TA17_293A_Hacktool_PS_1 {
   meta:
      description = "Auto-generated rule"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
      date = "2017-10-21"
      hash1 = "72a28efb6e32e653b656ca32ccd44b3111145a695f6f6161965deebbdc437076"
      id = "e4b92536-fa9a-5a65-8bd6-84c037dfbdce"
   strings:
      $x1 = "$HashFormat = '$krb5tgs$23$*ID#124_DISTINGUISHED NAME: CN=fakesvc,OU=Service,OU=Accounts,OU=EnterpriseObjects,DC=asdf,DC=pd,DC=f" ascii
      $x2 = "} | Where-Object {$_.SamAccountName -notmatch 'krbtgt'} | Get-SPNTicket @GetSPNTicketArguments" fullword ascii
   condition:
      ( filesize < 80KB and 1 of them )
}
YARA Detection Rule: TA17_293A_Hacktool_Touch_MAC_modification
Repository: Neo23x0/signature-base
Detects: Auto-generated rule
Author: Florian Roth (Nextron Systems)
Reference: https://www.us-cert.gov/ncas/alerts/TA17-293A

Pattern signatures:
$s1 = "-t time - use the time specified to update the access and modification times" fullword ascii
      $s2 = "Failed to set file times for %s. Error: %x" fullword ascii
      $s3 = "touch [-acm][ -r ref_file | -t time] file..." fullword ascii
      $s4 = "-m - change the modification time only" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )

Full rule:
rule TA17_293A_Hacktool_Touch_MAC_modification {
   meta:
      description = "Auto-generated rule"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
      date = "2017-10-21"
      hash1 = "070d7082a5abe[PII_REDACTED]14ec82241fd17e5bd465e24d794a470f699af88e"
      id = "69240cc0-a04e-544a-b7e3-c5a08c062055"
   strings:
      $s1 = "-t time - use the time specified to update the access and modification times" fullword ascii
      $s2 = "Failed to set file times for %s. Error: %x" fullword ascii
      $s3 = "touch [-acm][ -r ref_file | -t time] file..." fullword ascii
      $s4 = "-m - change the modification time only" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )
}
YARA Detection Rule: TA17_293A_Hacktool_Exploit_MS16_032
Repository: Neo23x0/signature-base
Detects: Auto-generated rule
Author: Florian Roth (Nextron Systems)
Reference: https://www.us-cert.gov/ncas/alerts/TA17-293A

Pattern signatures:
$x1 = "[?] Thread belongs to: $($(Get-Process -PID $([Kernel32]::GetProcessIdOfThread($Thread)))" ascii
      $x2 = "0x00000002, \"C:\\Windows\\System32\\cmd.exe\", \"\"," fullword ascii
      $x3 = "PowerShell implementation of MS16-032. The exploit targets all vulnerable" fullword ascii
      $x4 = "If we can't open the process token it's a SYSTEM shell!" fullword ascii

Detection condition:
( filesize < 40KB and 1 of them )

Full rule:
rule TA17_293A_Hacktool_Exploit_MS16_032 {
   meta:
      description = "Auto-generated rule"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
      date = "2017-10-21"
      hash1 = "9b97290300abb68fb48480718e6318ee2cdd4f099aa6438010fb2f44803e0b58"
      id = "4c5838d7-9956-564e-a25c-f2ba5641ac03"
   strings:
      $x1 = "[?] Thread belongs to: $($(Get-Process -PID $([Kernel32]::GetProcessIdOfThread($Thread)))" ascii
      $x2 = "0x00000002, \"C:\\Windows\\System32\\cmd.exe\", \"\"," fullword ascii
      $x3 = "PowerShell implementation of MS16-032. The exploit targets all vulnerable" fullword ascii
      $x4 = "If we can't open the process token it's a SYSTEM shell!" fullword ascii
   condition:
      ( filesize < 40KB and 1 of them )
}
YARA Detection Rule: Imphash_UPX_Packed_Malware_1_TA17_293A
Repository: Neo23x0/signature-base
Detects: Detects malware based on Imphash of malware used in TA17-293A
Author: Florian Roth (Nextron Systems)
Reference: https://www.us-cert.gov/ncas/alerts/TA17-293A

Detection condition:
( uint16(0) == 0x5a4d and filesize < 5000KB and pe.imphash() == "d7d745ea39c8c5b82d5e153d3313096c" )

Full rule:
rule Imphash_UPX_Packed_Malware_1_TA17_293A {
   meta:
      description = "Detects malware based on Imphash of malware used in TA17-293A"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
      date = "2017-10-21"
      hash1 = "a278256fbf2f061cfded7fdd58feded6765fade730374c508adad89282f67d77"
      id = "3ff28f06-8b69-5e8f-ab45-dfa4f6e69812"
   condition:
      ( uint16(0) == 0x5a4d and filesize < 5000KB and pe.imphash() == "d7d745ea39c8c5b82d5e153d3313096c" )
}
YARA Detection Rule: Imphash_Malware_2_TA17_293A
Repository: Neo23x0/signature-base
Detects: Detects malware based on Imphash of malware used in TA17-293A
Author: Florian Roth (Nextron Systems)
Reference: https://www.us-cert.gov/ncas/alerts/TA17-293A

Detection condition:
( uint16(0) == 0x5a4d and filesize < 5000KB and pe.imphash() == "a8f69eb2cf9f30ea96961c86b4347282" )

Full rule:
rule Imphash_Malware_2_TA17_293A : HIGHVOL {
   meta:
      description = "Detects malware based on Imphash of malware used in TA17-293A"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
      date = "2017-10-21"
      id = "5c9f32a3-8c50-5d46-929b-bbe14697540e"
   condition:
      ( uint16(0) == 0x5a4d and filesize < 5000KB and pe.imphash() == "a8f69eb2cf9f30ea96961c86b4347282" )
}
YARA Detection Rule: Cobaltgang_PDF_Metadata_Rev_A
Repository: Neo23x0/signature-base
Detects: Find documents saved from the same potential Cobalt Gang PDF template
Author: Palo Alto Networks Unit 42
Reference: https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/

Pattern signatures:
$ = "<xmpMM:DocumentID>uuid:31ac3688-619c-4fd4-8e3f-e59d0354a338" ascii wide

Detection condition:
any of them

Full rule:
rule Cobaltgang_PDF_Metadata_Rev_A {
   meta:
      description = "Find documents saved from the same potential Cobalt Gang PDF template"
      author = "Palo Alto Networks Unit 42"
      date = "2018-10-25"
      reference = "https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"
      id = "bcf5bf6e-c786-5f78-bf58-e0631a17e62e"
   strings:
      $ = "<xmpMM:DocumentID>uuid:31ac3688-619c-4fd4-8e3f-e59d0354a338" ascii wide
   condition:
      any of them
}
YARA Detection Rule: MAL_Backdoor_Naikon_APT_Sample1
Repository: Neo23x0/signature-base
Detects: Detects backdoors related to the Naikon APT
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/7vHyvh

Pattern signatures:
$x0 = "GET http://%s:%d/aspxabcdef.asp?%s HTTP/1.1" fullword ascii
      $x1 = "POST http://%s:%d/aspxabcdefg.asp?%s HTTP/1.1" fullword ascii
      $x2 = "greensky27.vicp.net" fullword ascii
      $x3 = "\\tempvxd.vxd.dll" wide
      $x5 = "otna.vicp.net" fullword ascii

      $s1 = "User-Agent: webclient" fullword ascii
      $s2 = "\\User.ini" ascii
      $s3 = "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/200" ascii
      $s4 = "\\UserProfile.dll" wide
      $s5 = "Connection:Keep-Alive: %d" fullword ascii
      $s6 = "Referer: http://%s:%d/" ascii
      $s7 = "%s %s %s %d %d %d " fullword ascii
      $s8 = "%s--%s" fullword wide
      $s9 = "Run File Success!" fullword wide
      $s10 = "DRIVE_REMOTE" fullword wide
      $s11 = "ProxyEnable" fullword wide
      $s12 = "\\cmd.exe" wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and
      (
         1 of ($x*) or 7 of ($s*)
      )

Full rule:
rule MAL_Backdoor_Naikon_APT_Sample1 {
   meta:
      description = "Detects backdoors related to the Naikon APT"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/7vHyvh"
      date = "2015-05-14"
		modified = "2023-01-06"
      hash = "d5716c80cba8554eb79eecfb4aa3d99faf0435a1833ec5ef51f528146c758eba"
      hash = "f5ab8e49c0778fa208baad660fe4fa40fc8a114f5f71614afbd6dcc09625cb96"
      id = "ba79285b-7c7f-5b19-837e-6696e50a2866"
   strings:
      $x0 = "GET http://%s:%d/aspxabcdef.asp?%s HTTP/1.1" fullword ascii
      $x1 = "POST http://%s:%d/aspxabcdefg.asp?%s HTTP/1.1" fullword ascii
      $x2 = "greensky27.vicp.net" fullword ascii
      $x3 = "\\tempvxd.vxd.dll" wide
      $x5 = "otna.vicp.net" fullword ascii

      $s1 = "User-Agent: webclient" fullword ascii
      $s2 = "\\User.ini" ascii
      $s3 = "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/200" ascii
      $s4 = "\\UserProfile.dll" wide
      $s5 = "Connection:Keep-Alive: %d" fullword ascii
      $s6 = "Referer: http://%s:%d/" ascii
      $s7 = "%s %s %s %d %d %d " fullword ascii
      $s8 = "%s--%s" fullword wide
      $s9 = "Run File Success!" fullword wide
      $s10 = "DRIVE_REMOTE" fullword wide
      $s11 = "ProxyEnable" fullword wide
      $s12 = "\\cmd.exe" wide
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and
      (
         1 of ($x*) or 7 of ($s*)
      )
}
YARA Detection Rule: Hermes2_1
Repository: Neo23x0/signature-base
Detects: Detects Hermes Ransomware as used in BAE report on FEIB
Author: BAE
Reference: https://baesystemsai.blogspot.de/2017/10/taiwan-heist-lazarus-tools.html

Pattern signatures:
//in both version 2.1 and sample in Feb
      $s1 = "SYSTEM\\CurrentControlSet\\Control\\Nls\\Language\\"
      $s2 = "0419"
      $s3 = "0422"
      $s4 = "0423"
      //in version 2.1 only
      $S1 = "HERMES"
      $S2 = "vssadminn"
      $S3 = "finish work"
      $S4 = "testlib.dll"
      $S5 = "shadowstorageiet"
      //maybe unique in the file
      $u1 = "ALKnvfoi4tbmiom3t40iomfr0i3t4jmvri3tb4mvi3btv3rgt4t777"
      $u2 = "HERMES 2.1 TEST BUILD, press ok"
      $u3 = "hnKwtMcOadHwnXutKHqPvpgfysFXfAFTcaDHNdCnktA" //RSA Key part

Detection condition:
uint16(0) == 0x5a4d and all of ($s*) and 3 of ($S*) and 1 of ($u*)

Full rule:
rule Hermes2_1 {
   meta:
      description = "Detects Hermes Ransomware as used in BAE report on FEIB"
      date = "2017/10/11"
      author = "BAE"
      reference = "https://baesystemsai.blogspot.de/2017/10/taiwan-heist-lazarus-tools.html"
      hash = "b27881f59c8d8cc529fa80a58709db36"
      id = "13397a43-04e1-5cc1-9[PII_REDACTED]013f3"
   strings:
      //in both version 2.1 and sample in Feb
      $s1 = "SYSTEM\\CurrentControlSet\\Control\\Nls\\Language\\"
      $s2 = "0419"
      $s3 = "0422"
      $s4 = "0423"
      //in version 2.1 only
      $S1 = "HERMES"
      $S2 = "vssadminn"
      $S3 = "finish work"
      $S4 = "testlib.dll"
      $S5 = "shadowstorageiet"
      //maybe unique in the file
      $u1 = "ALKnvfoi4tbmiom3t40iomfr0i3t4jmvri3tb4mvi3btv3rgt4t777"
      $u2 = "HERMES 2.1 TEST BUILD, press ok"
      $u3 = "hnKwtMcOadHwnXutKHqPvpgfysFXfAFTcaDHNdCnktA" //RSA Key part
   condition:
      uint16(0) == 0x5a4d and all of ($s*) and 3 of ($S*) and 1 of ($u*)
}
YARA Detection Rule: FVEY_ShadowBroker_violetspirit
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file violetspirit.README
Author: Florian Roth (Nextron Systems)
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message6/

Pattern signatures:
$x1 = "-i tgt_ipaddr -h tgt_hostname" fullword ascii

Detection condition:
1 of them

Full rule:
rule FVEY_ShadowBroker_violetspirit {
   meta:
      description = "Auto-generated rule - file violetspirit.README"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
      date = "2016-12-17"
      hash1 = "a55fec73595f885e43b27963afb17aee8f8eefe811ca027ef0d7721d073e67ea"
      id = "4efea734-8cbc-53f7-bf92-5b3253721a81"
   strings:
      $x1 = "-i tgt_ipaddr -h tgt_hostname" fullword ascii
   condition:
      1 of them
}
YARA Detection Rule: FVEY_ShadowBroker_gr_gr
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file gr.notes
Author: Florian Roth (Nextron Systems)
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message6/

Pattern signatures:
$s4 = "delete starting from: (root) LIST (root)" fullword ascii

Detection condition:
1 of them

Full rule:
rule FVEY_ShadowBroker_gr_gr {
   meta:
      description = "Auto-generated rule - file gr.notes"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
      date = "2016-12-17"
      hash1 = "b2b60dce7a4cfdddbd3d3f1825f[PII_REDACTED]bae009de3a307342fbdeeafcb79"
      id = "c233159d-8d78-575b-b32b-21f704debfe2"
   strings:
      $s4 = "delete starting from: (root) LIST (root)" fullword ascii
   condition:
      1 of them
}
YARA Detection Rule: FVEY_ShadowBroker_user_tool_yellowspirit
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file user.tool.yellowspirit.COMMON
Author: Florian Roth (Nextron Systems)
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message6/

Pattern signatures:
$s1 = "-l 19.16.1.1 -i 10.0.3.1 -n 2222 -r nscd -x 9999" fullword ascii
      $s2 = "-s PITCH_IP -x PITCH_IP -y RHP-24 TARGET_IP" fullword ascii

Detection condition:
1 of them

Full rule:
rule FVEY_ShadowBroker_user_tool_yellowspirit {
   meta:
      description = "Auto-generated rule - file user.tool.yellowspirit.COMMON"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
      date = "2016-12-17"
      hash1 = "a7c4b718fa92934a[PII_REDACTED]146ffa3312d9f3edc3872478c90e0e2814078c"
      id = "b1ca04e5-bac7-5247-b2d4-82c3515c92fc"
   strings:
      $s1 = "-l 19.16.1.1 -i 10.0.3.1 -n 2222 -r nscd -x 9999" fullword ascii
      $s2 = "-s PITCH_IP -x PITCH_IP -y RHP-24 TARGET_IP" fullword ascii
   condition:
      1 of them
}
YARA Detection Rule: FVEY_ShadowBroker_eleganteagle_opscript_1_0_0
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file eleganteagle_opscript.1.0.0.6
Author: Florian Roth (Nextron Systems)
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message6/

Pattern signatures:
$x3 = "uploadnrun -e \"D=-ucIP_ADDRESS_OF_REDIR" ascii

Detection condition:
1 of them

Full rule:
rule FVEY_ShadowBroker_eleganteagle_opscript_1_0_0 {
   meta:
      description = "Auto-generated rule - file eleganteagle_opscript.1.0.0.6"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
      date = "2016-12-17"
      hash1 = "57e223318de0a[PII_REDACTED]52b3dc766128f25d7e8f320c6f04c6f2659bb4f7f"
      id = "22855519-160c-57cf-b610-a611ca6813ed"
   strings:
      $x3 = "uploadnrun -e \"D=-ucIP_ADDRESS_OF_REDIR" ascii
   condition:
      1 of them
}
YARA Detection Rule: FVEY_ShadowBroker_opscript
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file opscript.se
Author: Florian Roth (Nextron Systems)
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message6/

Pattern signatures:
$s1 = "ls -l /tmp) | bdes -k 0x4790cae5ec154ccc|" ascii

Detection condition:
1 of them

Full rule:
rule FVEY_ShadowBroker_opscript {
   meta:
      description = "Auto-generated rule - file opscript.se"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
      date = "2016-12-17"
      hash1 = "275c91531a9ac5a[PII_REDACTED]93b6aa146b8d7463cb2780cfeeceaea4c789682"
      id = "d00752a3-d5c2-53a7-9a83-ad31cfb534af"
   strings:
      $s1 = "ls -l /tmp) | bdes -k 0x4790cae5ec154ccc|" ascii
   condition:
      1 of them
}