deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Trojan_Win32_Placisc4
Repository: Neo23x0/signature-base
Detects: Installer for Dipsind variant
Author: Microsoft

Pattern signatures:
$str1 = {8D 71 01 8B C6 99 BB 0A 00 00 00 F7 FB 0F BE D2 0F BE 04 39 2B C2 88 04 39 84 C0 74 0A}
		$str2 = {6A 04 68 00 20 00 00 68 00 00 40 00 6A 00 FF D5}
		$str3 = {C6 44 24 ?? 64 C6 44 24 ?? 6F C6 44 24 ?? 67 C6 44 24 ?? 32 C6 44 24 ?? 6A}

Detection condition:
$str1 and $str2 and $str3

Full rule:
rule Trojan_Win32_Placisc4 : Platinum
{
	meta:
		author = "Microsoft"
		description = "Installer for Dipsind variant"
		original_sample_sha1 = "3d17828632e8ff1560f6094703ece5433bc69586"
		unpacked_sample_sha1 = "2abb8e1e9cac24be474e4955c63108ff86d1a034"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"

		id = "04770059-06ca-5315-a7b3-0e9fbcecfc57"
	strings:
		$str1 = {8D 71 01 8B C6 99 BB 0A 00 00 00 F7 FB 0F BE D2 0F BE 04 39 2B C2 88 04 39 84 C0 74 0A}
		$str2 = {6A 04 68 00 20 00 00 68 00 00 40 00 6A 00 FF D5}
		$str3 = {C6 44 24 ?? 64 C6 44 24 ?? 6F C6 44 24 ?? 67 C6 44 24 ?? 32 C6 44 24 ?? 6A}

	condition:
		$str1 and $str2 and $str3
}
YARA Detection Rule: Trojan_Win32_Plakpers
Repository: Neo23x0/signature-base
Detects: Injector / loader component
Author: Microsoft

Pattern signatures:
$str1 = "MyFileMappingObject"
		$str2 = "[%.3u]  %s  %s  %s [%s:" wide
		$str3 = "%s\\{%s}\\%s" wide

Detection condition:
$str1 and $str2 and $str3

Full rule:
rule Trojan_Win32_Plakpers : Platinum
{
	meta:
		author = "Microsoft"
		description = "Injector / loader component"
		original_sample_sha1 = "fa083d744d278c6f4865f095cfd2feabee558056"
		unpacked_sample_sha1 = "3a678b5c9c46b5b87bfcb18306ed50fadfc6372e"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"

		id = "d37c6ac5-ca46-5fb2-80bd-ab63c8dbcd21"
	strings:
		$str1 = "MyFileMappingObject"
		$str2 = "[%.3u]  %s  %s  %s [%s:" wide
		$str3 = "%s\\{%s}\\%s" wide

	condition:
		$str1 and $str2 and $str3
}
YARA Detection Rule: Trojan_Win32_Plainst2
Repository: Neo23x0/signature-base
Detects: Zc tool
Author: Microsoft

Pattern signatures:
$str1 = "Connected [%s:%d]..."
		$str2 = "reuse possible: %c"
		$str3 = "] => %d%%\x0a"

Detection condition:
$str1 and $str2 and $str3

Full rule:
rule Trojan_Win32_Plainst2 : Platinum
{
	meta:
		author = "Microsoft"
		description = "Zc tool"
		original_sample_sha1 = "3f2ce812c38ff5ac3d813394291a5867e2cddcf2"
		unpacked_sample_sha1 = "88ff852b1b8077ad5a19cc438afb2402462fbd1a"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"

		id = "7202eeb5-269d-5e9a-9a93-bdf489639e74"
	strings:
		$str1 = "Connected [%s:%d]..."
		$str2 = "reuse possible: %c"
		$str3 = "] => %d%%\x0a"

	condition:
		$str1 and $str2 and $str3
}
YARA Detection Rule: Trojan_Win32_Plakpeer
Repository: Neo23x0/signature-base
Detects: Zc tool v2
Author: Microsoft

Pattern signatures:
$str1 = "@@E0020(%d)" wide
		$str2 = /exit.{0,3}@exit.{0,3}new.{0,3}query.{0,3}rcz.{0,3}scz/ wide
		$str3 = "---###---" wide
		$str4 = "---@@@---" wide

Detection condition:
$str1 and $str2 and $str3 and $str4

Full rule:
rule Trojan_Win32_Plakpeer : Platinum
{
	meta:
		author = "Microsoft"
		description = "Zc tool v2"
		original_sample_sha1 = "2155c[PII_REDACTED]7b5e3fde004bb604198463d29"
		unpacked_sample_sha1 = "dc991ef598825daabd9e70bac92c79154363bab2"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"

		id = "e573279b-4a7b-5e15-8ab2-a77cd98a8b6e"
	strings:
		$str1 = "@@E0020(%d)" wide
		$str2 = /exit.{0,3}@exit.{0,3}new.{0,3}query.{0,3}rcz.{0,3}scz/ wide
		$str3 = "---###---" wide
		$str4 = "---@@@---" wide

	condition:
		$str1 and $str2 and $str3 and $str4
}
YARA Detection Rule: WEBSHELL_Z_Webshell_2
Repository: Neo23x0/signature-base
Detects: Detection for the z_webshell
Author: DHS NCCIC Hunt and Incident Response Team

Pattern signatures:
$webshell_name = "public string z_progname =" nocase ascii wide
      $webshell_[CREDENTIAL_REDACTED] string Password =" nocase ascii wide

Detection condition:
( uint32(0) == 0x2040253c or uint32(0) == 0x7073613c )
      and filesize < 100KB
      and 2 of ($webshell_*)

Full rule:
rule WEBSHELL_Z_Webshell_2 {
   meta:
      description = "Detection for the z_webshell"
      author = "DHS NCCIC Hunt and Incident Response Team"
      date = "2018/01/25"
      old_rule_name = "z_webshell"
      md5 =  "2C9095C965A55EFC46E16B86F9B7D6C6"
      id = "9a54925f-de10-567f-a1ea-5e7522b47dfd"
   strings:
      $webshell_name = "public string z_progname =" nocase ascii wide
      $webshell_[CREDENTIAL_REDACTED] string Password =" nocase ascii wide
   condition:
      ( uint32(0) == 0x2040253c or uint32(0) == 0x7073613c )
      and filesize < 100KB
      and 2 of ($webshell_*)
}
YARA Detection Rule: TA18_074A_screen
Repository: Neo23x0/signature-base
Detects: Detects malware mentioned in TA18-074A
Author: Florian Roth (Nextron Systems)
Reference: https://www.us-cert.gov/ncas/alerts/TA18-074A

Pattern signatures:
$s1 = "screen.exe" fullword wide
      $s2 = "PlatformInvokeUSER32" fullword ascii
      $s3 = "GetDesktopImageF" fullword ascii
      $s4 = "PlatformInvokeGDI32" fullword ascii
      $s5 = "Too many arguments, going to store in current dir" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 60KB and 3 of them

Full rule:
rule TA18_074A_screen {
   meta:
      description = "Detects malware mentioned in TA18-074A"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.us-cert.gov/ncas/alerts/TA18-074A"
      date = "2018-03-16"
      hash1 = "2f159b71183a69928ba8f26b76772ec504aefeac71021b012bd006162e133731"
      id = "789ee5e5-83c3-5137-a078-ff230dbf8fcd"
   strings:
      $s1 = "screen.exe" fullword wide
      $s2 = "PlatformInvokeUSER32" fullword ascii
      $s3 = "GetDesktopImageF" fullword ascii
      $s4 = "PlatformInvokeGDI32" fullword ascii
      $s5 = "Too many arguments, going to store in current dir" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 60KB and 3 of them
}
YARA Detection Rule: TA18_074A_scripts
Repository: Neo23x0/signature-base
Detects: Detects malware mentioned in TA18-074A
Author: Florian Roth (Nextron Systems)
Reference: https://www.us-cert.gov/ncas/alerts/TA18-074A

Pattern signatures:
$s1 = "Running -s cmd /c query user on " ascii

Detection condition:
filesize < 600KB and 1 of them

Full rule:
rule TA18_074A_scripts {
   meta:
      description = "Detects malware mentioned in TA18-074A"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.us-cert.gov/ncas/alerts/TA18-074A"
      date = "2018-03-16"
      modified = "2022-08-18"
      hash1 = "2f159b71183a69928ba8f26b76772ec504aefeac71021b012bd006162e133731"
      id = "4c786098-c5f4-529b-8732-03183dfa94b5"
   strings:
      $s1 = "Running -s cmd /c query user on " ascii
   condition:
      filesize < 600KB and 1 of them
}
YARA Detection Rule: Typical_Malware_String_Transforms
Repository: Neo23x0/signature-base
Detects: Detects typical strings in a reversed or otherwise modified form
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
/* Executables */
		$e1 = "exe.tsohcvs" fullword ascii
		$e2 = "exe.ssasl" fullword ascii
		$e3 = "exe.rerolpxe" fullword ascii
		$e4 = "exe.erolpxei" fullword ascii
		$e5 = "exe.23lldnur" fullword ascii
		$e6 = "exe.dmc" fullword ascii
		$e7 = "exe.llikksat" fullword ascii

		/* Libraries */
		$l1 = "lld.23lenreK" fullword ascii
		$l2 = "lld.ESABLENREK" fullword ascii
		$l3 = "lld.esabtpyrc" fullword ascii
		$l4 = "lld.trcvsm" fullword ascii
		$l5 = "LLD.LLDTN" fullword ascii

		/* Imports */
		$i1 = "paeHssecorPteG" fullword ascii
		$i2 = "sserddAcorPteG" fullword ascii
		$i3 = "AyrarbiLdaoL" fullword ascii
		$i4 = "AssecorPetaerC" fullword ascii

		/* Registry */
		$r1 = "teSlortnoCtnerruC" fullword ascii
		$r2 = "nuR\\noisreVtnerruC" fullword ascii

		/* Folders */
		$f1 = "\\23metsys\\" ascii
		$f2 = "\\23metsyS\\" ascii
		$f3 = "niB.elcyceR$" fullword ascii
		$f4 = "%tooRmetsyS%" fullword ascii

		/* False Positives */
		$fp1 = "Application Impact Telemetry Static Analyzer" fullw

Detection condition:
( uint16(0) == 0x5a4d and 1 of them and not 1 of ($fp*) )

Full rule:
rule Typical_Malware_String_Transforms {
	meta:
		description = "Detects typical strings in a reversed or otherwise modified form"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-07-31"
		score = 60
		id = "86f348b5-0564-5d83-bbea-4f4a5f62fd30"
	strings:
		/* Executables */
		$e1 = "exe.tsohcvs" fullword ascii
		$e2 = "exe.ssasl" fullword ascii
		$e3 = "exe.rerolpxe" fullword ascii
		$e4 = "exe.erolpxei" fullword ascii
		$e5 = "exe.23lldnur" fullword ascii
		$e6 = "exe.dmc" fullword ascii
		$e7 = "exe.llikksat" fullword ascii

		/* Libraries */
		$l1 = "lld.23lenreK" fullword ascii
		$l2 = "lld.ESABLENREK" fullword ascii
		$l3 = "lld.esabtpyrc" fullword ascii
		$l4 = "lld.trcvsm" fullword ascii
		$l5 = "LLD.LLDTN" fullword ascii

		/* Imports */
		$i1 = "paeHssecorPteG" fullword ascii
		$i2 = "sserddAcorPteG" fullword ascii
		$i3 = "AyrarbiLdaoL" fullword ascii
		$i4 = "AssecorPetaerC" fullword ascii

		/* Registry */
		$r1 = "teSlortnoCtnerruC" fullword ascii
		$r2 = "nuR\\noisreVtnerruC" fullword ascii

		/* Folders */
		$f1 = "\\23metsys\\" ascii
		$f2 = "\\23metsyS\\" ascii
		$f3 = "niB.elcyceR$" fullword ascii
		$f4 = "%tooRmetsyS%" fullword ascii

		/* False Positives */
		$fp1 = "Application Impact Telemetry Static Analyzer" fullword wide
	condition:
		( uint16(0) == 0x5a4d and 1 of them and not 1 of ($fp*) )
}
YARA Detection Rule: BadRabbit_Gen
Repository: Neo23x0/signature-base
Detects: Detects BadRabbit Ransomware
Author: Florian Roth (Nextron Systems)
Reference: https://pastebin.com/Y7pJv3tK

Pattern signatures:
$x1 = "schtasks /Create /SC ONCE /TN viserion_%u /RU SYSTEM /TR \"%ws\" /ST" fullword wide
      $x2 = "schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR \"%ws /C Start \\\"\\\" \\\"%wsdispci.exe\\\"" fullword wide
      $x3 = "C:\\Windows\\infpub.dat" fullword wide
      $x4 = "C:\\Windows\\cscc.dat" fullword wide

      $s1 = "need to do is submit the payment and get the decryption password." fullword ascii
      $s2 = "\\\\.\\GLOBALROOT\\ArcName\\multi(0)disk(0)rdisk(0)partition(1)" fullword wide
      $s3 = "\\\\.\\pipe\\%ws" fullword wide
      $s4 = "fsutil usn deletejournal /D %c:" fullword wide
      $s5 = "Run DECRYPT app at your desktop after system boot" fullword ascii
      $s6 = "Files decryption completed" fullword wide
      $s7 = "Disable your anti-virus and anti-malware programs" fullword wide
      $s8 = "SYSTEM\\CurrentControlSet\\services\\%ws" fullword wide
      $s9 = "process call create \"C:\\Windows\\System32\\rundll32.exe" fullword wide
      $s10 = "%ws

Detection condition:
uint16(0) == 0x5a4d and filesize < 700KB and ( 1 of ($x*) or 2 of them )

Full rule:
rule BadRabbit_Gen {
   meta:
      description = "Detects BadRabbit Ransomware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://pastebin.com/Y7pJv3tK"
      date = "2017-10-25"
      hash1 = "8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93"
      hash2 = "579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648"
      hash3 = "630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da"
      id = "272e50f8-5aef-52ec-a5d0-01e8504d6c55"
   strings:
      $x1 = "schtasks /Create /SC ONCE /TN viserion_%u /RU SYSTEM /TR \"%ws\" /ST" fullword wide
      $x2 = "schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR \"%ws /C Start \\\"\\\" \\\"%wsdispci.exe\\\"" fullword wide
      $x3 = "C:\\Windows\\infpub.dat" fullword wide
      $x4 = "C:\\Windows\\cscc.dat" fullword wide

      $s1 = "need to do is submit the payment and get the decryption password." fullword ascii
      $s2 = "\\\\.\\GLOBALROOT\\ArcName\\multi(0)disk(0)rdisk(0)partition(1)" fullword wide
      $s3 = "\\\\.\\pipe\\%ws" fullword wide
      $s4 = "fsutil usn deletejournal /D %c:" fullword wide
      $s5 = "Run DECRYPT app at your desktop after system boot" fullword ascii
      $s6 = "Files decryption completed" fullword wide
      $s7 = "Disable your anti-virus and anti-malware programs" fullword wide
      $s8 = "SYSTEM\\CurrentControlSet\\services\\%ws" fullword wide
      $s9 = "process call create \"C:\\Windows\\System32\\rundll32.exe" fullword wide
      $s10 = "%ws C:\\Windows\\%ws,#1 %ws" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 700KB and ( 1 of ($x*) or 2 of them )
}
YARA Detection Rule: BadRabbit_Mimikatz_Comp
Repository: Neo23x0/signature-base
Detects: Auto-generated rule
Author: Florian Roth (Nextron Systems)
Reference: https://pastebin.com/Y7pJv3tK

Pattern signatures:
$s1 = "%lS%lS%lS:%lS" fullword wide
      $s2 = "lsasrv" fullword wide
      $s3 = "CredentialKeys" ascii
      /* Primary\x00m\x00s\x00v */
      $s4 = { 50 72 69 6D 61 72 79 00 6D 00 73 00 76 00 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and 3 of them )

Full rule:
rule BadRabbit_Mimikatz_Comp {
   meta:
      description = "Auto-generated rule"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://pastebin.com/Y7pJv3tK"
      date = "2017-10-25"
      hash1 = "2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035"
      id = "52affd3f-6bf9-55f6-92a5-69314a2e76e0"
   strings:
      $s1 = "%lS%lS%lS:%lS" fullword wide
      $s2 = "lsasrv" fullword wide
      $s3 = "CredentialKeys" ascii
      /* Primary\x00m\x00s\x00v */
      $s4 = { 50 72 69 6D 61 72 79 00 6D 00 73 00 76 00 }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and 3 of them )
}
YARA Detection Rule: MAL_WIPER_CaddyWiper_Mar22_1
Repository: Neo23x0/signature-base
Detects: Detects CaddyWiper malware
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/ESETresearch/status/[PII_REDACTED]86712321?s=20&t=xh8JK6fEmRIrnqO7Ih_PNg

Pattern signatures:
$op1 = { ff 55 94 8b 45 fc 50 ff 55 f8 8a 4d ba 88 4d ba 8a 55 ba 80 ea 01 }
      $op2 = { 89 45 f4 83 7d f4 00 74 04 eb 47 eb 45 6a 00 8d 95 1c ff ff ff 52 }
      $op3 = { 6a 20 6a 02 8d 4d b0 51 ff 95 68 ff ff ff 85 c0 75 0a e9 4e 02 00 00 }
      $op4 = { e9 67 01 00 00 83 7d f4 05 74 0a e9 5c 01 00 00 e9 57 01 00 00 8d 45 98 50 6a 20 }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 50KB and 3 of them or all of them

Full rule:
rule MAL_WIPER_CaddyWiper_Mar22_1 {
   meta:
      description = "Detects CaddyWiper malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/ESETresearch/status/[PII_REDACTED]86712321?s=20&t=xh8JK6fEmRIrnqO7Ih_PNg"
      date = "2022-03-15"
      score = 85
      hash1 = "1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176"
      hash2 = "a[PII_REDACTED]34a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea"
      hash3 = "ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72"
      hash4 = "f1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902"
      id = "83495a0d-a295-5ec7-9761-ce79918e1034"
   strings:
      $op1 = { ff 55 94 8b 45 fc 50 ff 55 f8 8a 4d ba 88 4d ba 8a 55 ba 80 ea 01 }
      $op2 = { 89 45 f4 83 7d f4 00 74 04 eb 47 eb 45 6a 00 8d 95 1c ff ff ff 52 }
      $op3 = { 6a 20 6a 02 8d 4d b0 51 ff 95 68 ff ff ff 85 c0 75 0a e9 4e 02 00 00 }
      $op4 = { e9 67 01 00 00 83 7d f4 05 74 0a e9 5c 01 00 00 e9 57 01 00 00 8d 45 98 50 6a 20 }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 50KB and 3 of them or all of them
}
YARA Detection Rule: ReflectiveLoader
Repository: Neo23x0/signature-base
Detects: Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "ReflectiveLoader" fullword ascii
      $x2 = "ReflectivLoader.dll" fullword ascii
      $x3 = "?ReflectiveLoader@@" ascii
      $x4 = "reflective_dll.x64.dll" fullword ascii
      $x5 = "reflective_dll.dll" fullword ascii

      $fp1 = "Sentinel Labs, Inc." wide
      $fp2 = "Panda Security, S.L." wide ascii

Detection condition:
uint16(0) == 0x5a4d and (
            1 of ($x*) or
            pe.exports("ReflectiveLoader") or
            pe.exports("_ReflectiveLoader@4") or
            pe.exports("?ReflectiveLoader@@YGKPAX@Z")
         )
      and not 1 of ($fp*)

Full rule:
rule ReflectiveLoader {
   meta:
      description = "Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended"
      reference = "Internal Research"
      score = 70
      date = "2017-07-17"
      modified = "2021-03-15"
      author = "Florian Roth (Nextron Systems)"
      nodeepdive = 1
      id = "d8a601d7-b99a-59dc-bfc7-bf0e35b5d8bd"
   strings:
      $x1 = "ReflectiveLoader" fullword ascii
      $x2 = "ReflectivLoader.dll" fullword ascii
      $x3 = "?ReflectiveLoader@@" ascii
      $x4 = "reflective_dll.x64.dll" fullword ascii
      $x5 = "reflective_dll.dll" fullword ascii

      $fp1 = "Sentinel Labs, Inc." wide
      $fp2 = "Panda Security, S.L." wide ascii
   condition:
      uint16(0) == 0x5a4d and (
            1 of ($x*) or
            pe.exports("ReflectiveLoader") or
            pe.exports("_ReflectiveLoader@4") or
            pe.exports("?ReflectiveLoader@@YGKPAX@Z")
         )
      and not 1 of ($fp*)
}
YARA Detection Rule: Reflective_DLL_Loader_Aug17_1
Repository: Neo23x0/signature-base
Detects: Detects Reflective DLL Loader
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "\\Release\\reflective_dll.pdb" ascii
      $x2 = "reflective_dll.x64.dll" fullword ascii
      $s3 = "DLL Injection" fullword ascii
      $s4 = "?ReflectiveLoader@@YA_KPEAX@Z" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and
        filesize < 300KB and
        (
           pe.imphash() == "4bf489ae7d1e6575f5bb81ae4d10862f" or
           pe.exports("?ReflectiveLoader@@YA_KPEAX@Z") or
           ( 1 of ($x*) or 2 of them )
        )
      ) or ( 2 of them )

Full rule:
rule Reflective_DLL_Loader_Aug17_1 {
   meta:
      description = "Detects Reflective DLL Loader"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-08-20"
      hash1 = "f2f[PII_REDACTED]5eec629e6fc5333cf325a620531d[PII_REDACTED]24a88564e320"
      id = "9a2674f8-5fdb-5a4d-a2b9-41e874939616"
   strings:
      $x1 = "\\Release\\reflective_dll.pdb" ascii
      $x2 = "reflective_dll.x64.dll" fullword ascii
      $s3 = "DLL Injection" fullword ascii
      $s4 = "?ReflectiveLoader@@YA_KPEAX@Z" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and
        filesize < 300KB and
        (
           pe.imphash() == "4bf489ae7d1e6575f5bb81ae4d10862f" or
           pe.exports("?ReflectiveLoader@@YA_KPEAX@Z") or
           ( 1 of ($x*) or 2 of them )
        )
      ) or ( 2 of them )
}
YARA Detection Rule: DLL_Injector_Lynx
Repository: Neo23x0/signature-base
Detects: Detects Lynx DLL Injector
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = " -p <TARGET PROCESS NAME> | -u <DLL PAYLOAD> [--obfuscate]" fullword wide
      $x2 = "You've selected to inject into process: %s" fullword wide
      $x3 = "Lynx DLL Injector" fullword wide
      $x4 = "Reflective DLL Injector" fullword wide
      $x5 = "Failed write payload: %lu" fullword wide
      $x6 = "Failed to start payload: %lu" fullword wide
      $x7 = "Injecting payload..." fullword wide

Detection condition:
( uint16(0) == 0x5a4d and
        filesize < 800KB and
        1 of them
      ) or ( 3 of them )

Full rule:
rule DLL_Injector_Lynx {
   meta:
      description = "Detects Lynx DLL Injector"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-08-20"
      hash1 = "d594f60e766e0c3261a599b385e3f686b159a992d19fa624fad8761776efa4f0"
      id = "7a4c9949-c701-5ae2-a8b1-3ef0b08c1c04"
   strings:
      $x1 = " -p <TARGET PROCESS NAME> | -u <DLL PAYLOAD> [--obfuscate]" fullword wide
      $x2 = "You've selected to inject into process: %s" fullword wide
      $x3 = "Lynx DLL Injector" fullword wide
      $x4 = "Reflective DLL Injector" fullword wide
      $x5 = "Failed write payload: %lu" fullword wide
      $x6 = "Failed to start payload: %lu" fullword wide
      $x7 = "Injecting payload..." fullword wide
   condition:
      ( uint16(0) == 0x5a4d and
        filesize < 800KB and
        1 of them
      ) or ( 3 of them )
}
YARA Detection Rule: Reflective_DLL_Loader_Aug17_2
Repository: Neo23x0/signature-base
Detects: Detects Reflective DLL Loader - suspicious - Possible FP could be program crack
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "\\ReflectiveDLLInjection-master\\" ascii
      $s2 = "reflective_dll.dll" fullword ascii
      $s3 = "DLL injection" fullword ascii
      $s4 = "_ReflectiveLoader@4" ascii
      $s5 = "Reflective Dll Injection" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and
        filesize < 200KB and
        (
           pe.imphash() == "59867122bcc8c959ad307ac2dd08af79" or
           pe.exports("_ReflectiveLoader@4") or
           2 of them
        )
      ) or ( 3 of them )

Full rule:
rule Reflective_DLL_Loader_Aug17_2 {
   meta:
      description = "Detects Reflective DLL Loader - suspicious - Possible FP could be program crack"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-08-20"
      score = 60
      hash1 = "c2a7a2d0b05ad42386a2bedb780205b7c0af76fe9ee3d47bbe217562f627fcae"
      hash2 = "b90831aaf8859e604283e5292158f08f100d4a2d4e1875ea1911750a6cb85fe0"
      id = "5948d9ba-e655-5b11-ad74-f650b3a753e7"
   strings:
      $x1 = "\\ReflectiveDLLInjection-master\\" ascii
      $s2 = "reflective_dll.dll" fullword ascii
      $s3 = "DLL injection" fullword ascii
      $s4 = "_ReflectiveLoader@4" ascii
      $s5 = "Reflective Dll Injection" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and
        filesize < 200KB and
        (
           pe.imphash() == "59867122bcc8c959ad307ac2dd08af79" or
           pe.exports("_ReflectiveLoader@4") or
           2 of them
        )
      ) or ( 3 of them )
}