deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT_UNC2447_MAL_SOMBRAT_May21_1
Repository: Neo23x0/signature-base
Detects: Detects SombRAT samples from UNC2447 campaign
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html

Pattern signatures:
$x1 = "~arungvc" ascii fullword

      $s1 = "plugin64_" ascii
      $s2 = "0xUnknown" ascii fullword
      $s3 = "b%x.%s" ascii fullword
      $s4 = "/news" ascii

      $sc1 = { 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 73
               00 2E 00 65 00 78 00 65 00 00 00 00 00 00 00 00
               00 49 73 57 6F 77 36 34 50 72 6F 63 65 73 73 00
               00 6B 00 65 00 72 00 6E 00 65 00 6C 00 33 00 32
               00 00 00 00 00 00 00 00 00 47 00 6C 00 6F 00 62
               00 61 00 6C 00 5C 00 25 00 73 }

      $op1 = { 66 90 0f b6 45 80 32 44 0d 81 34 de 88 44 0d 81 48 ff c1 48 83 f9 19 72 e9 }
      $op2 = { 48 8b d0 66 0f 6f 05 ?1 ?? 0? 00 f3 0f 7f 44 24 68 66 89 7c 24 58 41 b8 10 00 00 00 4c 39 40 10 4c 0f 42 40 10 48 83 78 18 08 }
      $op3 = { 49 f7 b0 a0 00 00 00 42 0f b6 04 0a 41 30 44 33 fe 48 83 79 18 10 72 03 48 8b 09 33 d2 b8 05 00 00 00 }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 3000KB and (
         ( 1 of ($x*) and 1 of ($s*) ) or
         3 of them
      ) or 5 of them

Full rule:
rule APT_UNC2447_MAL_SOMBRAT_May21_1 {
   meta:
      description = "Detects SombRAT samples from UNC2447 campaign"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
      date = "2021-05-01"
      modified = "2023-01-07"
      hash1 = "61e286c62e556ac79b01c17357176e58efb67d86c5d17407e128094c3151f7f9"
      hash2 = "99baffcd7a6b939b72c99af7c1e88523a50053ab966a079d9bf268aff884426e"
      id = "78b46bed-4fd4-596f-bba7-12243f467af3"
   strings:
      $x1 = "~arungvc" ascii fullword

      $s1 = "plugin64_" ascii
      $s2 = "0xUnknown" ascii fullword
      $s3 = "b%x.%s" ascii fullword
      $s4 = "/news" ascii

      $sc1 = { 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 73
               00 2E 00 65 00 78 00 65 00 00 00 00 00 00 00 00
               00 49 73 57 6F 77 36 34 50 72 6F 63 65 73 73 00
               00 6B 00 65 00 72 00 6E 00 65 00 6C 00 33 00 32
               00 00 00 00 00 00 00 00 00 47 00 6C 00 6F 00 62
               00 61 00 6C 00 5C 00 25 00 73 }

      $op1 = { 66 90 0f b6 45 80 32 44 0d 81 34 de 88 44 0d 81 48 ff c1 48 83 f9 19 72 e9 }
      $op2 = { 48 8b d0 66 0f 6f 05 ?1 ?? 0? 00 f3 0f 7f 44 24 68 66 89 7c 24 58 41 b8 10 00 00 00 4c 39 40 10 4c 0f 42 40 10 48 83 78 18 08 }
      $op3 = { 49 f7 b0 a0 00 00 00 42 0f b6 04 0a 41 30 44 33 fe 48 83 79 18 10 72 03 48 8b 09 33 d2 b8 05 00 00 00 }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 3000KB and (
         ( 1 of ($x*) and 1 of ($s*) ) or
         3 of them
      ) or 5 of them
}
YARA Detection Rule: APT_UNC2447_MAL_RANSOM_HelloKitty_May21_1
Repository: Neo23x0/signature-base
Detects: Detects HelloKitty Ransomware samples from UNC2447 campaign
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html

Pattern signatures:
$xop1 = { 8b 45 08 8b 75 f4 fe 85 f7 fd ff ff 0f 11 44 05 b4 83 c0 10 89 45 08 83 f8 30 7c 82 }
      $xop2 = { 81 c3 dc a9 b0 5c c1 c9 0b 33 c8 89 55 a0 8b c7 8b 7d e0 c1 c8 06 33 f7 }

      $s1 = "select * from Win32_ShadowCopy" wide fullword
      $s2 = "bootfont.bin" wide fullword
      $s3 = "DECRYPT_NOTE.txt" wide fullword
      $s4 = ".onion" wide
      
      $sop1 = { 8b f9 0f 57 c0 68 18 01 00 00 6a 00 0f 11 45 dc 8d 5f 20 53 0f 11 45 ec }
      $sop2 = { 56 57 8b f9 0f 57 c0 68 18 01 00 00 6a 00 0f 11 45 dc 8d 5f 20 }
      $sop3 = { 57 8b f9 0f 57 c0 68 18 01 00 00 6a 00 0f 11 45 dc 8d 5f 20 53 }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 800KB and
      1 of ($x*) or 3 of them

Full rule:
rule APT_UNC2447_MAL_RANSOM_HelloKitty_May21_1 {
   meta:
      description = "Detects HelloKitty Ransomware samples from UNC2447 campaign"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
      date = "2021-05-01"
      hash1 = "02a08b994265901a649f1bcf6772bc06df2eb51eb09906af9fd0f4a8103e9851"
      hash2 = "0e5f7737704c8f25b2b8157561be54a463057cd4d79c7e016c30a1cf6590a85c"
      hash3 = "52dace403e8f9b4f7ea20c0c3565fa11b6953b404a7d49d63af237a57b36fd2a"
      hash4 = "7be901c5f7ffeb8f99e4f5813c259d[PII_REDACTED]380ed06df03fb836a041cb06"
      hash5 = "947e357bfdfe411be6c97af6559fd1cdc5c9d6f5cea122bf174d124ee03d2de8"
      hash6 = "9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0"
      hash7 = "a147945635d5bd0fa832c9b55bc3ebcea7a7787e8f89b98a44279f8eddda2a77"
      hash8 = "bade05a30aba181ffbe4325c1ba6c76ef9e02cbe41a4190bd3671152c51c4a7b"
      hash9 = "c2498845ed4b287fd0f95528926c8ee620ef0cbb5b27865b2007d6379ffe4323"
      hash10 = "dc007e[PII_REDACTED]3ca68a919e37687427b7e6db0c24ca014c148f226d8dd98f"
      hash11 = "ef614b456ca4eaa8156a895f450577600ad41bd553b4512ae6abf3fb8b5eb04e"
      id = "c84b2430-dcf1-5a80-96a0-02d292ea386b"
   strings:
      $xop1 = { 8b 45 08 8b 75 f4 fe 85 f7 fd ff ff 0f 11 44 05 b4 83 c0 10 89 45 08 83 f8 30 7c 82 }
      $xop2 = { 81 c3 dc a9 b0 5c c1 c9 0b 33 c8 89 55 a0 8b c7 8b 7d e0 c1 c8 06 33 f7 }

      $s1 = "select * from Win32_ShadowCopy" wide fullword
      $s2 = "bootfont.bin" wide fullword
      $s3 = "DECRYPT_NOTE.txt" wide fullword
      $s4 = ".onion" wide
      
      $sop1 = { 8b f9 0f 57 c0 68 18 01 00 00 6a 00 0f 11 45 dc 8d 5f 20 53 0f 11 45 ec }
      $sop2 = { 56 57 8b f9 0f 57 c0 68 18 01 00 00 6a 00 0f 11 45 dc 8d 5f 20 }
      $sop3 = { 57 8b f9 0f 57 c0 68 18 01 00 00 6a 00 0f 11 45 dc 8d 5f 20 53 }
   condition:
      uint16(0) == 0x5a4d and
      filesize
YARA Detection Rule: APT_UNC2447_MAL_RANSOM_HelloKitty_May21_2
Repository: Neo23x0/signature-base
Detects: Detects HelloKitty Ransomware samples from UNC2447 campaign
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html

Pattern signatures:
$xop1 = { 50 8d 45 f8 50 ff 75 fc ff 15 ?? ?? 42 00 3d ea 00 00 00 75 18 83 7d f8 00 }

      $s1 = "HelloKittyMutex" wide
      $s2 = "%s\\read_me_lkd.txt" wide fullword
      $s3 = "/C ping 127.0.0.1 & del %s" wide fullword
      $s4 = "(%d) [%d] %s: STOP DOUBLE PROCESS RUN" ascii fullword
      
      $sop1 = { 6a 00 6a 01 ff 75 fc ff 15 ?? ?? 42 00 85 c0 0f 94 c3 ff 75 fc ff 15 ?? ?? 42 00 }
      $sop2 = { 74 12 6a 00 6a 01 ff 75 fc ff 15 ?? ?? 42 00 85 c0 0f 94 c3 ff 75 fc }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 600KB and
      1 of ($x*) or 2 of them

Full rule:
rule APT_UNC2447_MAL_RANSOM_HelloKitty_May21_2 {
   meta:
      description = "Detects HelloKitty Ransomware samples from UNC2447 campaign"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
      date = "2021-05-01"
      hash1 = "10887d13dba1f83ef34e047455a04416d25a83079a7f3798ce3483e0526e3768"
      hash2 = "3ae7bedf236d4e53a33f3a3e1e80eae2d93e91b1988da2f7fcb8fde5dcc3a0e9"
      hash3 = "501487b025f25ddf1ca32deb57a2b4db43ccf6635c1edc74b9cff54ce0e5bcfe"
      hash4 = "9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0"
      id = "82aaabc6-102a-512e-8c2a-4d6fda864c68"
   strings:
      $xop1 = { 50 8d 45 f8 50 ff 75 fc ff 15 ?? ?? 42 00 3d ea 00 00 00 75 18 83 7d f8 00 }

      $s1 = "HelloKittyMutex" wide
      $s2 = "%s\\read_me_lkd.txt" wide fullword
      $s3 = "/C ping 127.0.0.1 & del %s" wide fullword
      $s4 = "(%d) [%d] %s: STOP DOUBLE PROCESS RUN" ascii fullword
      
      $sop1 = { 6a 00 6a 01 ff 75 fc ff 15 ?? ?? 42 00 85 c0 0f 94 c3 ff 75 fc ff 15 ?? ?? 42 00 }
      $sop2 = { 74 12 6a 00 6a 01 ff 75 fc ff 15 ?? ?? 42 00 85 c0 0f 94 c3 ff 75 fc }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 600KB and
      1 of ($x*) or 2 of them
}
YARA Detection Rule: APT_UNC2447_PS1_WARPRISM_May21_1
Repository: Neo23x0/signature-base
Detects: Detects WARPRISM PowerShell samples from UNC2447 campaign
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html

Pattern signatures:
$x1 = "if ($MyInvocation.MyCommand.Path -match '\\S') {" ascii fullword

      $s1 = "[DllImport(\"kernel32.dll\")]public static extern IntPtr VirtualAlloc(IntPtr " ascii wide
      $s2 = "[Runtime.InteropServices.Marshal]::Copy($" ascii wide
      $s3 = "[System.Diagnostics.Process]::Start((-join(" ascii wide

Detection condition:
filesize < 5000KB and 1 of ($x*) or 2 of them

Full rule:
rule APT_UNC2447_PS1_WARPRISM_May21_1 {
   meta:
      description = "Detects WARPRISM PowerShell samples from UNC2447 campaign"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
      date = "2021-05-01"
      hash1 = "3090bff3d16b0b150444c3bfb196229ba0ab0b6b826fa306803de0192beddb80"
      hash2 = "63ba6db8c81c60dd9f1a0c7c4a4c51e2e56883f063509ed7b543ad7651fd8806"
      hash3 = "b41a303a4caa71fa260dd601a796033d8bfebcaa6bd9dfd7ad956fac5229a735"
      id = "fa389a45-3b31-5a84-9882-49fd6ee8cac5"
   strings:
      $x1 = "if ($MyInvocation.MyCommand.Path -match '\\S') {" ascii fullword

      $s1 = "[DllImport(\"kernel32.dll\")]public static extern IntPtr VirtualAlloc(IntPtr " ascii wide
      $s2 = "[Runtime.InteropServices.Marshal]::Copy($" ascii wide
      $s3 = "[System.Diagnostics.Process]::Start((-join(" ascii wide
   condition:
      filesize < 5000KB and 1 of ($x*) or 2 of them
}
YARA Detection Rule: APT_UNC2447_BAT_Runner_May21_1
Repository: Neo23x0/signature-base
Detects: Detects Batch script runners from UNC2447 campaign
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html

Pattern signatures:
$x1 = "powershell.exe -c \"[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String([IO.File]::" ascii
      $x2 = "wwansvc.txt')))\" | powershell.exe -" ascii

Detection condition:
filesize < 5000KB and 1 of them

Full rule:
rule APT_UNC2447_BAT_Runner_May21_1 {
   meta:
      description = "Detects Batch script runners from UNC2447 campaign"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
      date = "2021-05-01"
      modified = "2023-01-07"
      hash1 = "ccacf4658ae778d02e4e55cd161b5a0772eb8b8eee62fed34e2d8f11db2cc4bc"
      id = "0bacd4f7-421a-570f-9f74-5a19ab806dd0"
   strings:
      $x1 = "powershell.exe -c \"[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String([IO.File]::" ascii
      $x2 = "wwansvc.txt')))\" | powershell.exe -" ascii
   condition:
      filesize < 5000KB and 1 of them
}
YARA Detection Rule: Locky_Ransomware
Repository: Neo23x0/signature-base
Detects: Detects Locky Ransomware (matches also on Win32/Kuluoz)
Author: Florian Roth (Nextron Systems) (with the help of binar.ly)
Reference: https://goo.gl/qScSrE

Pattern signatures:
$o1 = { 45 b8 99 f7 f9 0f af 45 b8 89 45 b8 } // address=0x4144a7
		$o2 = { 2b 0a 0f af 4d f8 89 4d f8 c7 45 } // address=0x413863

Detection condition:
all of ($o*)

Full rule:
rule Locky_Ransomware {
	meta:
		description = "Detects Locky Ransomware (matches also on Win32/Kuluoz)"
		author = "Florian Roth (Nextron Systems) (with the help of binar.ly)"
		reference = "https://goo.gl/qScSrE"
		date = "2016-02-17"
		hash = "5e945c1d27c9ad77a2b63ae10af46aee7d29a6a43605a9bfbf35cebbcff184d8"
		id = "ce61e01e-a9ce-54f4-bd2d-8acf1d5fbc30"
	strings:
		$o1 = { 45 b8 99 f7 f9 0f af 45 b8 89 45 b8 } // address=0x4144a7
		$o2 = { 2b 0a 0f af 4d f8 89 4d f8 c7 45 } // address=0x413863
	condition:
		all of ($o*)
}
YARA Detection Rule: APT_APT10_Malware_Imphash_Dec18_1
Repository: Neo23x0/signature-base
Detects: Detects APT10 malware based on ImpHashes
Author: Florian Roth (Nextron Systems)
Reference: AlienVault OTX IOCs - statistical sample analysis

Detection condition:
uint16(0) == 0x5a4d and filesize < 6000KB and (
         pe.imphash() == "0556ff5e5f8744bff47d4921494ba46d" or
         pe.imphash() == "cb1194123f68a68eb14552c085b620ce" or
         pe.imphash() == "efad9ff8c0d2a6419bf1dd970bcd806d" or
         pe.imphash() == "7a861cd9c495e1d950a43cb708a22985" or


Full rule:
rule APT_APT10_Malware_Imphash_Dec18_1 {
   meta:
      description = "Detects APT10 malware based on ImpHashes"
      author = "Florian Roth (Nextron Systems)"
      reference = "AlienVault OTX IOCs - statistical sample analysis"
      date = "2018-12-28"
      id = "2de195a3-63a4-50ac-a83d-ab0db0f784bf"
   condition:
      uint16(0) == 0x5a4d and filesize < 6000KB and (
         pe.imphash() == "0556ff5e5f8744bff47d4921494ba46d" or
         pe.imphash() == "cb1194123f68a68eb14552c085b620ce" or
         pe.imphash() == "efad9ff8c0d2a6419bf1dd970bcd806d" or
         pe.imphash() == "7a861cd9c495e1d950a43cb708a22985" or
         pe.imphash() == "a5d0545030be75a421529c2b0be6c4bd" or
         pe.imphash() == "94491f4a812b0297419dc888aa4fd2a5"
      )
}
YARA Detection Rule: MAL_RANSOM_DarkBit_Feb23_1
Repository: Neo23x0/signature-base
Detects: Detects indicators found in DarkBit ransomware
Author: Florian Roth
Reference: https://twitter.com/idonaor1/status/[PII_REDACTED]70005506?s=12&t=mxHaauzwR6YOj5Px8cIeIw

Pattern signatures:
$s1 = ".onion" ascii
      $s2 = "GetMOTWHostUrl"

      $x1 = "hus31m7c7ad.onion"
      $x2 = "iw6v2p3cruy"
      $xn1 = "You will receive decrypting key after the payment."

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 10MB and (
         1 of ($x*) or 2 of them
      ) or 4 of them
      or ( filesize < 10MB and $xn1 ) // Ransom note

Full rule:
rule MAL_RANSOM_DarkBit_Feb23_1 {
   meta:
      description = "Detects indicators found in DarkBit ransomware"
      author = "Florian Roth"
      reference = "https://twitter.com/idonaor1/status/[PII_REDACTED]70005506?s=12&t=mxHaauzwR6YOj5Px8cIeIw"
      date = "2023-02-13"
      score = 75
      id = "d209a0c2-f649-5fb1-9ecd-f1c35caa796f"
   strings:
      $s1 = ".onion" ascii
      $s2 = "GetMOTWHostUrl"

      $x1 = "hus31m7c7ad.onion"
      $x2 = "iw6v2p3cruy"
      $xn1 = "You will receive decrypting key after the payment."
   condition:
      uint16(0) == 0x5a4d and
      filesize < 10MB and (
         1 of ($x*) or 2 of them
      ) or 4 of them
      or ( filesize < 10MB and $xn1 ) // Ransom note
}
YARA Detection Rule: MAL_RANSOM_DarkBit_Feb23_2
Repository: Neo23x0/signature-base
Detects: Detects Go based DarkBit ransomware (garbled code; could trigger on other obfuscated samples, too)
Author: Florian Roth
Reference: https://www.hybrid-analysis.com/sample/9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff?environmentId=160

Pattern signatures:
$s1 = "runtime.initLongPathSupport" ascii fullword
      $s2 = "reflect." ascii
      $s3 = "    \"processes\": []," ascii fullword
      $s4 = "^!* %!(!" ascii fullword

      $op1 = { 4d 8b b6 00 00 00 00 48 8b 94 24 40 05 00 00 31 c0 87 82 30 03 00 00 b8 01 00 00 00 f0 0f c1 82 00 03 00 00 48 8b 44 24 48 48 8b 0d ba 1f 32 00 }
      $op2 = { 49 8d 49 01 0f 1f 00 48 39 d9 7c e2 b9 0b 00 00 00 49 89 d8 e9 28 fc ff ff e8 89 6c d7 ff }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 20000KB and all of them

Full rule:
rule MAL_RANSOM_DarkBit_Feb23_2 {
   meta:
      description = "Detects Go based DarkBit ransomware (garbled code; could trigger on other obfuscated samples, too)"
      author = "Florian Roth"
      reference = "https://www.hybrid-analysis.com/sample/9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff?environmentId=160"
      date = "2023-02-13"
      score = 75
      hash1 = "9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff"
      id = "f530815c-68e7-55f1-8e36-bc74a1059584"
   strings:
      $s1 = "runtime.initLongPathSupport" ascii fullword
      $s2 = "reflect." ascii
      $s3 = "    \"processes\": []," ascii fullword
      $s4 = "^!* %!(!" ascii fullword

      $op1 = { 4d 8b b6 00 00 00 00 48 8b 94 24 40 05 00 00 31 c0 87 82 30 03 00 00 b8 01 00 00 00 f0 0f c1 82 00 03 00 00 48 8b 44 24 48 48 8b 0d ba 1f 32 00 }
      $op2 = { 49 8d 49 01 0f 1f 00 48 39 d9 7c e2 b9 0b 00 00 00 49 89 d8 e9 28 fc ff ff e8 89 6c d7 ff }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 20000KB and all of them
}
YARA Detection Rule: PowerShdll
Repository: Neo23x0/signature-base
Detects: Detects hack tool PowerShdll
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/p3nt4/PowerShdll

Pattern signatures:
$x1 = "rundll32 PowerShdll,main -f <path>" fullword wide
      $x2 = "\\PowerShdll.dll" ascii
      $x3 = "rundll32 PowerShdll,main <script>" fullword wide

Detection condition:
1 of them

Full rule:
rule PowerShdll {
   meta:
      description = "Detects hack tool PowerShdll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/p3nt4/PowerShdll"
      date = "2017-08-03"
      hash1 = "4d33bc7cfa79d7eefc5f7a99f1b052afdb84895a411d7c30045498fd4303898a"
      hash2 = "f999db9cc3a0719c19f35f0e760f4ce3377b31b756d8cd91bb8270acecd7be7d"
      id = "cc0e01ca-77f0-5665-8b1e-48c8e947d0d3"
   strings:
      $x1 = "rundll32 PowerShdll,main -f <path>" fullword wide
      $x2 = "\\PowerShdll.dll" ascii
      $x3 = "rundll32 PowerShdll,main <script>" fullword wide
   condition:
      1 of them
}
YARA Detection Rule: APT_PupyRAT_PY
Repository: Neo23x0/signature-base
Detects: Detects Pupy RAT
Author: Florian Roth (Nextron Systems)
Reference: https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations

Pattern signatures:
$x1 = "reflective_inject_dll" fullword ascii
      $x2 = "ImportError: pupy builtin module not found !" fullword ascii
      $x3 = "please start pupy from either it's exe stub or it's reflective DLLR;" fullword ascii
      $x4 = "[INJECT] inject_dll." fullword ascii
      $x5 = "import base64,zlib;exec zlib.decompress(base64.b64decode('eJzzcQz1c/ZwDbJVT87Py0tNLlHnAgA56wXS'))" fullword ascii

      $op1 = { 8b 42 0c 8b 78 14 89 5c 24 18 89 7c 24 14 3b fd } /* Opcode */

Detection condition:
( uint16(0) == 0x5a4d and filesize < 20000KB and 1 of them ) or ( 2 of them )

Full rule:
rule APT_PupyRAT_PY {
   meta:
      description = "Detects Pupy RAT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations"
      date = "2017-02-17"
      hash1 = "8d89f53b0a6558d6bb9cdbc9f218ef699f3c87dd06bc03dd042290dedc18cb71"
      id = "cdd689e3-437e-514d-a058-fad80ce0639e"
   strings:
      $x1 = "reflective_inject_dll" fullword ascii
      $x2 = "ImportError: pupy builtin module not found !" fullword ascii
      $x3 = "please start pupy from either it's exe stub or it's reflective DLLR;" fullword ascii
      $x4 = "[INJECT] inject_dll." fullword ascii
      $x5 = "import base64,zlib;exec zlib.decompress(base64.b64decode('eJzzcQz1c/ZwDbJVT87Py0tNLlHnAgA56wXS'))" fullword ascii

      $op1 = { 8b 42 0c 8b 78 14 89 5c 24 18 89 7c 24 14 3b fd } /* Opcode */
   condition:
      ( uint16(0) == 0x5a4d and filesize < 20000KB and 1 of them ) or ( 2 of them )
}
YARA Detection Rule: APT_MagicHound_MalMacro
Repository: Neo23x0/signature-base
Detects: Detects malicious macro / powershell in Office document
Author: Florian Roth (Nextron Systems)
Reference: https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations

Pattern signatures:
$s1 = "powershell.exe " fullword ascii
      $s2 = "CommandButton1_Click" fullword ascii
      $s3 = "URLDownloadToFile" fullword ascii

Detection condition:
( uint16(0) == 0xcfd0 and filesize < 8000KB and all of them )

Full rule:
rule APT_MagicHound_MalMacro {
   meta:
      description = "Detects malicious macro / powershell in Office document"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations"
      date = "2017-02-17"
      super_rule = 1
      hash1 = "66d24a529308d8ab7b27ddd43a6c2db84107b831257efb664044ec4437f9487b"
      hash2 = "e5b643cb6ec30d0d0b458e3f2800609f260a5f15c4ac66faf4ebf384f7976df6"
      id = "ad573f52-dbda-5852-ad73-9ef47dd6e7df"
   strings:
      $s1 = "powershell.exe " fullword ascii
      $s2 = "CommandButton1_Click" fullword ascii
      $s3 = "URLDownloadToFile" fullword ascii
   condition:
      ( uint16(0) == 0xcfd0 and filesize < 8000KB and all of them )
}
YARA Detection Rule: MAL_CrypRAT_Jan19_1
Repository: Neo23x0/signature-base
Detects: Detects CrypRAT
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "Cryp_RAT" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 600KB and (
         pe.imphash() == "2524e5e9fe04d7bfe5efb3a5e400fe4b" or
         1 of them
      )

Full rule:
rule MAL_CrypRAT_Jan19_1 {
   meta:
      description = "Detects CrypRAT"
      author = "Florian Roth (Nextron Systems)"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      reference = "Internal Research"
      score = 90
      date = "2019-01-07"
      id = "f3063a16-8813-5d6c-9807-6a0725907fb5"
   strings:
      $x1 = "Cryp_RAT" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 600KB and (
         pe.imphash() == "2524e5e9fe04d7bfe5efb3a5e400fe4b" or
         1 of them
      )
}
YARA Detection Rule: WEBSHELL_ASPX_Sharepoint_Drop_CVE_2025_53770_Jul25
Repository: Neo23x0/signature-base
Detects: Detects ASPX web shell dropped during the exploitation of SharePoint RCE vulnerability CVE-2025-53770
Author: Florian Roth
Reference: https://research.eye.security/sharepoint-under-siege/

Pattern signatures:
$x1 = "var sy = System.Reflection.Assembly.Load(" ascii
      $x2 = "Response.Write(cg.ValidationKey+" ascii

      $s1 = "<script runat=\"server\" language=\"c#\" CODEPAGE=\"65001\">" ascii fullword

Detection condition:
filesize < 4KB
      and 1 of ($x*)
      or all of them

Full rule:
rule WEBSHELL_ASPX_Sharepoint_Drop_CVE_2025_53770_Jul25 {
   meta:
      description = "Detects ASPX web shell dropped during the exploitation of SharePoint RCE vulnerability CVE-2025-53770"
      author = "Florian Roth"
      reference = "https://research.eye.security/sharepoint-under-siege/"
      date = "2025-07-20"
      score = 80
      hash = "27c45b8ed7b8a7e5fff473b50c24028bd028a9fe8e25e5cea2bf5e676e531014"
      hash = "92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514"
      hash = "b336f936be13b3d01a8544ea[PII_REDACTED]022b40c28dd8f1f281e361c9b64e93"
   strings:
      $x1 = "var sy = System.Reflection.Assembly.Load(" ascii
      $x2 = "Response.Write(cg.ValidationKey+" ascii

      $s1 = "<script runat=\"server\" language=\"c#\" CODEPAGE=\"65001\">" ascii fullword
   condition:
      filesize < 4KB
      and 1 of ($x*)
      or all of them
}