deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: dll_UnReg
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file UnReg.bat
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "regsvr32.exe /u C:\\windows\\system32\\PacketX.dll" fullword ascii 
        $s1 = "del /F /Q C:\\windows\\system32\\PacketX.dll" fullword ascii

Detection condition:
filesize < 1KB and 1 of them

Full rule:
rule dll_UnReg {
    meta:
        description = "Chinese Hacktool Set - file UnReg.bat"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        reference = "http://tools.zjqhr.com/"
        date = "2015-06-13"
        hash = "d5e24ba86781c332d0c99dea62f42b14e893d17e"
        id = "5c14486d-72a2-5a18-9db0-ce0ab61fdce7"
    strings:
        $s0 = "regsvr32.exe /u C:\\windows\\system32\\PacketX.dll" fullword ascii 
        $s1 = "del /F /Q C:\\windows\\system32\\PacketX.dll" fullword ascii 
    condition:
        filesize < 1KB and 1 of them
}
YARA Detection Rule: dll_Reg
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file Reg.bat
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "copy PacketX.dll C:\\windows\\system32\\PacketX.dll" fullword ascii 
        $s1 = "regsvr32.exe C:\\windows\\system32\\PacketX.dll" fullword ascii

Detection condition:
filesize < 1KB and all of them

Full rule:
rule dll_Reg {
    meta:
        description = "Chinese Hacktool Set - file Reg.bat"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        reference = "http://tools.zjqhr.com/"
        date = "2015-06-13"
        hash = "cb8a92fe256a3e5b869f9564ecd1aa9c5c886e3f"
        id = "97c0d9ff-6a12-57e3-8219-6c1843a03a29"
    strings:
        $s0 = "copy PacketX.dll C:\\windows\\system32\\PacketX.dll" fullword ascii 
        $s1 = "regsvr32.exe C:\\windows\\system32\\PacketX.dll" fullword ascii 
    condition:
        filesize < 1KB and all of them
}
YARA Detection Rule: sbin_squid
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file squid.bat
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "del /s /f /q" fullword ascii
        $s1 = "squid.exe -z" fullword ascii
        $s2 = "net start Squid" fullword ascii 
        $s3 = "net stop Squid" fullword ascii

Detection condition:
filesize < 1KB and all of them

Full rule:
rule sbin_squid {
    meta:
        description = "Chinese Hacktool Set - file squid.bat"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        reference = "http://tools.zjqhr.com/"
        date = "2015-06-13"
        hash = "8b795a8085c3e6f3d764ebcfe6d59e26fdb91969"
        id = "e7302e90-d072-599b-a8f2-bf1f21a84de9"
    strings:
        $s0 = "del /s /f /q" fullword ascii
        $s1 = "squid.exe -z" fullword ascii
        $s2 = "net start Squid" fullword ascii 
        $s3 = "net stop Squid" fullword ascii 
    condition:
        filesize < 1KB and all of them
}
YARA Detection Rule: sql1433_creck
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file creck.bat
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "start anhao3.exe -i S.txt -p  pass3.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii 
        $s1 = "start anhao1.exe -i S.txt -p  pass1.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii 
        $s2 = "start anhao2.exe -i S.txt -p  pass2.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii

Detection condition:
uint16(0) == 0x7473 and filesize < 1KB and 1 of them

Full rule:
rule sql1433_creck {
    meta:
        description = "Chinese Hacktool Set - file creck.bat"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        reference = "http://tools.zjqhr.com/"
        date = "2015-06-13"
        hash = "189c11a3b268789a3fbcfac3bd4e03cbfde87b1d"
        id = "38a91464-d493-5154-86ec-e54b3e25309b"
    strings:
        $s0 = "start anhao3.exe -i S.txt -p  pass3.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii 
        $s1 = "start anhao1.exe -i S.txt -p  pass1.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii 
        $s2 = "start anhao2.exe -i S.txt -p  pass2.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii 
    condition:
        uint16(0) == 0x7473 and filesize < 1KB and 1 of them
}
YARA Detection Rule: sql1433_Start
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file Start.bat
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s1 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii 
        $s2 = "start creck.bat" fullword ascii 
        $s3 = "del s1.txt" fullword ascii
        $s4 = "del Result.txt" fullword ascii
        $s5 = "del s.TXT" fullword ascii
        $s6 = "mode con cols=48 lines=20" fullword ascii

Detection condition:
filesize < 1KB and 2 of them

Full rule:
rule sql1433_Start {
    meta:
        description = "Chinese Hacktool Set - file Start.bat"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        reference = "http://tools.zjqhr.com/"
        date = "2015-06-13"
        hash = "bd4be10f4c3a982647b2da1a8fb2e19de34eaf01"
        id = "89bc249d-dba0-5196-b081-ddbd029ae6c8"
    strings:
        $s1 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii 
        $s2 = "start creck.bat" fullword ascii 
        $s3 = "del s1.txt" fullword ascii
        $s4 = "del Result.txt" fullword ascii
        $s5 = "del s.TXT" fullword ascii
        $s6 = "mode con cols=48 lines=20" fullword ascii
    condition:
        filesize < 1KB and 2 of them
}
YARA Detection Rule: SUSP_LNX_Sindoor_ELF_Obfuscation_Aug25
Repository: Neo23x0/signature-base
Detects: Detects ELF obfuscation technique used by Sindoor dropper related to APT 36
Author: Pezier Pierre-Henri
Reference: Internal Research

Pattern signatures:
$s1 = "UPX!"

Detection condition:
filesize < 10MB
      and uint16(0) == 0
      and uint16(4) > 0
      and $s1 in (0xc0..0x100)

Full rule:
rule SUSP_LNX_Sindoor_ELF_Obfuscation_Aug25 {
   meta:
      description = "Detects ELF obfuscation technique used by Sindoor dropper related to APT 36"
      author = "Pezier Pierre-Henri"
      date = "2025-08-29"
      score = 70
      reference = "Internal Research"
      hash = "6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443"
   strings:
      $s1 = "UPX!"
   condition:
      filesize < 10MB
      and uint16(0) == 0
      and uint16(4) > 0
      and $s1 in (0xc0..0x100)
}
YARA Detection Rule: SUSP_LNX_Sindoor_DesktopFile_Aug25
Repository: Neo23x0/signature-base
Detects: Detects ELF obfuscation technique used by Sindoor dropper related to APT 36
Author: Pezier Pierre-Henri
Reference: Internal Research

Pattern signatures:
$hdr = "[Desktop Entry]"
      $s1 = "printf '\\\\x7FELF' | dd of"
      $s2 = "Future_Note_Warfare_OpSindoor.pdf"

Detection condition:
filesize < 100KB
      and $hdr
      and any of ($s*)

Full rule:
rule SUSP_LNX_Sindoor_DesktopFile_Aug25 {
   meta:
      description = "Detects ELF obfuscation technique used by Sindoor dropper related to APT 36"
      author = "Pezier Pierre-Henri"
      date = "2025-08-29"
      score = 70
      reference = "Internal Research"
      hash = "9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59"
   strings:
      $hdr = "[Desktop Entry]"
      $s1 = "printf '\\\\x7FELF' | dd of"
      $s2 = "Future_Note_Warfare_OpSindoor.pdf"
   condition:
      filesize < 100KB
      and $hdr
      and any of ($s*)
}
YARA Detection Rule: MAL_Sindoor_Decryptor_Aug25
Repository: Neo23x0/signature-base
Detects: Detects AES decryptor used by Sindoor dropper related to APT 36
Author: Pezier Pierre-Henri
Reference: Internal Research

Pattern signatures:
$s1 = "Go build"
      $s2 = "main.rc4EncryptDecrypt"
      $s3 = "main.processFile"
      $s4 = "main.deriveKeyAES"
      $s5 = "use RC4 instead of AES"

Detection condition:
filesize < 100MB
      and (
         uint16(0) == 0x5a4d // Windows
         or uint32be(0) == 0x7f454c46  // Linux
         or (uint32be(0) == 0xcafebabe and uint32be(4) < 0x20)  // Universal mach-O App with dont-match-java-class-file hack
         or uint32(0) == 0xfeedface  // 32-bit mach-O
    

Full rule:
rule MAL_Sindoor_Decryptor_Aug25 {
   meta:
      description = "Detects AES decryptor used by Sindoor dropper related to APT 36"
      author = "Pezier Pierre-Henri"
      date = "2025-08-29"
      score = 80
      reference = "Internal Research"
      hash = "9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b"
   strings:
      $s1 = "Go build"
      $s2 = "main.rc4EncryptDecrypt"
      $s3 = "main.processFile"
      $s4 = "main.deriveKeyAES"
      $s5 = "use RC4 instead of AES"
   condition:
      filesize < 100MB
      and (
         uint16(0) == 0x5a4d // Windows
         or uint32be(0) == 0x7f454c46  // Linux
         or (uint32be(0) == 0xcafebabe and uint32be(4) < 0x20)  // Universal mach-O App with dont-match-java-class-file hack
         or uint32(0) == 0xfeedface  // 32-bit mach-O
         or uint32(0) == 0xfeedfacf  // 64-bit mach-O
      )
      and all of them
}
YARA Detection Rule: MAL_Sindoor_Downloader_Aug25
Repository: Neo23x0/signature-base
Detects: Detects Sindoor downloader related to APT 36
Author: Pezier Pierre-Henri
Reference: Internal Research

Pattern signatures:
$s1 = "Go build"
      $s2 = "main.downloadFile.deferwrap"
      $s3 = "main.decrypt"
      $s4 = "main.HiddenHome"
      $s5 = "main.RealCheck"

Detection condition:
filesize < 100MB
      and (
         uint16(0) == 0x5a4d // Windows
         or uint32be(0) == 0x7f454c46  // Linux
         or (uint32be(0) == 0xcafebabe and uint32be(4) < 0x20)  // Universal mach-O App with dont-match-java-class-file hack
         or uint32(0) == 0xfeedface  // 32-bit mach-O
    

Full rule:
rule MAL_Sindoor_Downloader_Aug25 {
   meta:
      description = "Detects Sindoor downloader related to APT 36"
      author = "Pezier Pierre-Henri"
      date = "2025-08-29"
      score = 80
      reference = "Internal Research"
      hash = "38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4"
   strings:
      $s1 = "Go build"
      $s2 = "main.downloadFile.deferwrap"
      $s3 = "main.decrypt"
      $s4 = "main.HiddenHome"
      $s5 = "main.RealCheck"
   condition:
      filesize < 100MB
      and (
         uint16(0) == 0x5a4d // Windows
         or uint32be(0) == 0x7f454c46  // Linux
         or (uint32be(0) == 0xcafebabe and uint32be(4) < 0x20)  // Universal mach-O App with dont-match-java-class-file hack
         or uint32(0) == 0xfeedface  // 32-bit mach-O
         or uint32(0) == 0xfeedfacf  // 64-bit mach-O
      )
      and all of them
}
YARA Detection Rule: WEBSHELL_Csharp_Hash_String_Oct22
Repository: Neo23x0/signature-base
Detects: C# webshell using specific hash check for the password.
Author: Nils Kuhnert (modified by Florian Roth)

Pattern signatures:
$gen1 = "void Page_Load" ascii
		$gen2 = "FromBase64String" ascii
		$gen3 = "CryptoServiceProvider" ascii
		$gen4 = "ComputeHash" ascii

		$hashing1 = "BitConverter.ToString(" ascii /* Webshell uses ToString from a string: BitConverter.ToString(ptqVQ) */
		$hashing2 = ").Replace(\"-\", \"\") == \"" ascii

      $filter1 = "BitConverter.ToString((" ascii /* Usually it's something like: return ((BitConverter.ToString((new SHA1CryptoServiceProvider() */

Detection condition:
filesize < 10KB 
		and all of ($gen*) and all of ($hashing*)
		and not 1 of ($filter*)

Full rule:
rule WEBSHELL_Csharp_Hash_String_Oct22 {
	meta:
		description = "C# webshell using specific hash check for the password."
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Nils Kuhnert (modified by Florian Roth)"
		hash = "29c187ad46d3059dc25d5f0958e0e8789fb2a51b9daaf90ea27f001b1a9a603c"
		date = "2022-10-27"
		score = 60
		id = "c7d459be-5e61-57b7-b738-051c0cec62d2"
	strings:
		$gen1 = "void Page_Load" ascii
		$gen2 = "FromBase64String" ascii
		$gen3 = "CryptoServiceProvider" ascii
		$gen4 = "ComputeHash" ascii

		$hashing1 = "BitConverter.ToString(" ascii /* Webshell uses ToString from a string: BitConverter.ToString(ptqVQ) */
		$hashing2 = ").Replace(\"-\", \"\") == \"" ascii

      $filter1 = "BitConverter.ToString((" ascii /* Usually it's something like: return ((BitConverter.ToString((new SHA1CryptoServiceProvider() */
	condition:
		filesize < 10KB 
		and all of ($gen*) and all of ($hashing*)
		and not 1 of ($filter*)
}
YARA Detection Rule: WindowsCredentialEditor
Repository: Neo23x0/signature-base
Detects: Windows Credential Editor

Pattern signatures:
$a = "extract the TGT session key"
      $b = "Windows Credentials Editor"

Detection condition:
all of them

Full rule:
rule WindowsCredentialEditor {
   meta:
      description = "Windows Credential Editor"
      threat_level = 10
      score = 90
      id = "1542c6e4-36b2-5272-85d0-43226869b43e"
   strings:
      $a = "extract the TGT session key"
      $b = "Windows Credentials Editor"
   condition:
      all of them
}
YARA Detection Rule: HKTL_Amplia_Security_Tool
Repository: Neo23x0/signature-base
Detects: Detects Amplia Security Tool like Windows Credential Editor
Author: Florian Roth

Pattern signatures:
$a = "Amplia Security"
      $c = "getlsasrvaddr.exe"
      $d = "Cannot get PID of LSASS.EXE"
      $e = "extract the TGT session key"
      $f = "PPWDUMP_DATA"

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 3000KB and (
         2 of them
      ) or 3 of them

Full rule:
rule HKTL_Amplia_Security_Tool {
   meta:
      description = "Detects Amplia Security Tool like Windows Credential Editor"
      score = 60
      nodeepdive = 1
      author = "Florian Roth"
      date = "2013-01-01"
      modified = "2023-02-14"
      id = "4ad83f34-561d-53ce-9766-e21700354da7"
   strings:
      $a = "Amplia Security"
      $c = "getlsasrvaddr.exe"
      $d = "Cannot get PID of LSASS.EXE"
      $e = "extract the TGT session key"
      $f = "PPWDUMP_DATA"
   condition:
      uint16(0) == 0x5a4d and
      filesize < 3000KB and (
         2 of them
      ) or 3 of them
}
YARA Detection Rule: PwDump
Repository: Neo23x0/signature-base
Detects: PwDump 6 variant
Author: Marc Stroebel

Pattern signatures:
$s5 = "Usage: %s [-x][-n][-h][-o output_file][-u user][-p password][-s share] machineNa"
      $s6 = "Unable to query service status. Something is wrong, please manually check the st"
      $s7 = "pwdump6 Version %s by fizzgig and the mighty group at foofus.net" fullword

Detection condition:
1 of them

Full rule:
rule PwDump {
   meta:
      description = "PwDump 6 variant"
      author = "Marc Stroebel"
      date = "2014-04-24"
      score = 70
      id = "e557e548-53e8-5098-93d4-8e899384e67c"
   strings:
      $s5 = "Usage: %s [-x][-n][-h][-o output_file][-u user][-p password][-s share] machineNa"
      $s6 = "Unable to query service status. Something is wrong, please manually check the st"
      $s7 = "pwdump6 Version %s by fizzgig and the mighty group at foofus.net" fullword
   condition:
      1 of them
}
YARA Detection Rule: PScan_Portscan_1
Repository: Neo23x0/signature-base
Detects: PScan - Port Scanner
Author: F. Roth

Pattern signatures:
$a = "00050;0F0M0X0a0v0}0"
      $b = "vwgvwgvP76"
      $c = "Pr0PhOFyP"

Detection condition:
all of them

Full rule:
rule PScan_Portscan_1 {
   meta:
      description = "PScan - Port Scanner"
      author = "F. Roth"
      score = 50
      id = "54997776-644b-5a72-b08c-7174b7dc7f66"
   strings:
      $a = "00050;0F0M0X0a0v0}0"
      $b = "vwgvwgvP76"
      $c = "Pr0PhOFyP"
   condition:
      all of them
}
YARA Detection Rule: HackTool_Samples
Repository: Neo23x0/signature-base
Detects: Hacktool

Pattern signatures:
$a = "Unable to uninstall the fgexec service"
      $b = "Unable to set socket to sniff"
      $c = "Failed to load SAM functions"
      $d = "Dump system passwords"
      $e = "Error opening sam hive or not valid file"
      $f = "Couldn't find LSASS pid"
      $g = "samdump.dll"
      $h = "WPEPRO SEND PACKET"
      $i = "WPE-C1467211-7C89-49c5-801A-1D048E4014C4"
      $j = "Usage: unshadow PASSWORD-FILE SHADOW-FILE"
      $k = "arpspoof\\Debug"
      $l = "Success: The log has been cleared"
      $m = "clearlogs [\\\\computername"
      $n = "DumpUsers 1."
      $o = "dictionary attack with specified dictionary file"
      $p = "by Objectif Securite"
      $q = "objectif-securite"
      $r = "Cannot query LSA Secret on remote host"
      $s = "Cannot write to process memory on remote host"
      $t = "Cannot start PWDumpX service on host"
      $u = "usage: %s <system hive> <security hive>"
      $v = "username:domainname:LMhash:NThash"
      $w = "<server_name_or_ip> | -f <server_l

Detection condition:
1 of them

Full rule:
rule HackTool_Samples {
   meta:
      description = "Hacktool"
      score = 50
      id = "ecacf84a-f66c-5c21-ae4b-fd9bfb5be384"
   strings:
      $a = "Unable to uninstall the fgexec service"
      $b = "Unable to set socket to sniff"
      $c = "Failed to load SAM functions"
      $d = "Dump system passwords"
      $e = "Error opening sam hive or not valid file"
      $f = "Couldn't find LSASS pid"
      $g = "samdump.dll"
      $h = "WPEPRO SEND PACKET"
      $i = "WPE-C1467211-7C89-49c5-801A-1D048E4014C4"
      $j = "Usage: unshadow PASSWORD-FILE SHADOW-FILE"
      $k = "arpspoof\\Debug"
      $l = "Success: The log has been cleared"
      $m = "clearlogs [\\\\computername"
      $n = "DumpUsers 1."
      $o = "dictionary attack with specified dictionary file"
      $p = "by Objectif Securite"
      $q = "objectif-securite"
      $r = "Cannot query LSA Secret on remote host"
      $s = "Cannot write to process memory on remote host"
      $t = "Cannot start PWDumpX service on host"
      $u = "usage: %s <system hive> <security hive>"
      $v = "username:domainname:LMhash:NThash"
      $w = "<server_name_or_ip> | -f <server_list_file> [username] [password]"
      $x = "Impersonation Tokens Available"
      $y = "failed to parse pwdump format string"
      $z = "Dumping password"
   condition:
      1 of them
}
YARA Detection Rule: Fierce2
Repository: Neo23x0/signature-base
Detects: This signature detects the Fierce2 domain scanner
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "$tt_xml->process( 'end_domainscan.tt', $end_domainscan_vars,"

Detection condition:
1 of them

Full rule:
rule Fierce2 {
   meta:
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      description = "This signature detects the Fierce2 domain scanner"
      date = "01.07.2014"
      score = 60
      id = "08a72151-48c2-513b-995f-be0d5acba7dd"
   strings:
      $s1 = "$tt_xml->process( 'end_domainscan.tt', $end_domainscan_vars,"
   condition:
      1 of them
}
YARA Detection Rule: Ncrack
Repository: Neo23x0/signature-base
Detects: This signature detects the Ncrack brute force tool
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "NcrackOutputTable only supports adding up to 4096 to a cell via"

Detection condition:
1 of them

Full rule:
rule Ncrack {
   meta:
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      description = "This signature detects the Ncrack brute force tool"
      date = "01.07.2014"
      score = 60
      id = "c1c56ee9-7f76-5440-b0e0-86e372c53340"
   strings:
      $s1 = "NcrackOutputTable only supports adding up to 4096 to a cell via"
   condition:
      1 of them
}
YARA Detection Rule: SQLMap
Repository: Neo23x0/signature-base
Detects: This signature detects the SQLMap SQL injection tool
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "except SqlmapBaseException, ex:"

Detection condition:
1 of them

Full rule:
rule SQLMap {
   meta:
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      description = "This signature detects the SQLMap SQL injection tool"
      date = "01.07.2014"
      score = 60
      id = "55a72fe6-f82d-5d55-842f-5d7e1cfcc9fa"
   strings:
      $s1 = "except SqlmapBaseException, ex:"
   condition:
      1 of them
}
YARA Detection Rule: HKTL_PortScanner_Simple_Jan14
Repository: Neo23x0/signature-base
Detects: Auto-generated rule on file PortScanner.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s0 = "Scan Ports Every"
      $s3 = "Scan All Possible Ports!"

Detection condition:
all of them

Full rule:
rule HKTL_PortScanner_Simple_Jan14 {
   meta:
      description = "Auto-generated rule on file PortScanner.exe"
      author = "yarGen Yara Rule Generator by Florian Roth"
      hash = "b381b9212282c0c650cb4b0323436c63"
      old_rule_name = "PortScanner"
      id = "3e8960ce-0428-51e1-b992-4fa09fee8520"
   strings:
      $s0 = "Scan Ports Every"
      $s3 = "Scan All Possible Ports!"
   condition:
      all of them
}
YARA Detection Rule: DomainScanV1_0
Repository: Neo23x0/signature-base
Detects: Auto-generated rule on file DomainScanV1_0.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s0 = "dIJMuX$aO-EV"
      $s1 = "XELUxP\"-\\"
      $s2 = "KaR\"U'}-M,."
      $s3 = "V.)\\ZDxpLSav"
      $s4 = "Decompress error"
      $s5 = "Can't load library"
      $s6 = "Can't load function"
      $s7 = "com0tl32:.d"

Detection condition:
all of them

Full rule:
rule DomainScanV1_0 {
   meta:
      description = "Auto-generated rule on file DomainScanV1_0.exe"
      author = "yarGen Yara Rule Generator by Florian Roth"
      hash = "aefcd73b802e1c2bdc9b2ef206a4f24e"
      id = "94ead827-8b29-5cb5-82b6-a7ca5087bf7e"
   strings:
      $s0 = "dIJMuX$aO-EV"
      $s1 = "XELUxP\"-\\"
      $s2 = "KaR\"U'}-M,."
      $s3 = "V.)\\ZDxpLSav"
      $s4 = "Decompress error"
      $s5 = "Can't load library"
      $s6 = "Can't load function"
      $s7 = "com0tl32:.d"
   condition:
      all of them
}
YARA Detection Rule: HKTL_MooreR_Port_Scanner
Repository: Neo23x0/signature-base
Detects: Auto-generated rule on file MooreR Port Scanner.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s0 = "Description|"
      $s3 = "soft Visual Studio\\VB9yp"
      $s4 = "adj_fptan?4"
      $s7 = "DOWS\\SyMem32\\/o"

Detection condition:
all of them

Full rule:
rule HKTL_MooreR_Port_Scanner {
   meta:
      description = "Auto-generated rule on file MooreR Port Scanner.exe"
      author = "yarGen Yara Rule Generator by Florian Roth"
      hash = "376304acdd0b0251c8b19fea20bb6f5b"
      id = "5d8fb83f-bed3-53d2-bd33-2158911dc7c8"
   strings:
      $s0 = "Description|"
      $s3 = "soft Visual Studio\\VB9yp"
      $s4 = "adj_fptan?4"
      $s7 = "DOWS\\SyMem32\\/o"
   condition:
      all of them
}
YARA Detection Rule: NetBIOS_Name_Scanner
Repository: Neo23x0/signature-base
Detects: Auto-generated rule on file NetBIOS Name Scanner.exe
Author: yarGen Yara Rule Generator by Florian Roth

Pattern signatures:
$s0 = "IconEx"
      $s2 = "soft Visual Stu"
      $s4 = "NBTScanner!y&"

Detection condition:
all of them

Full rule:
rule NetBIOS_Name_Scanner {
   meta:
      description = "Auto-generated rule on file NetBIOS Name Scanner.exe"
      author = "yarGen Yara Rule Generator by Florian Roth"
      hash = "888ba1d391e14c0a9c829f5a1964ca2c"
      id = "03716e00-a969-5ab5-9be7-e8fc4272e40f"
   strings:
      $s0 = "IconEx"
      $s2 = "soft Visual Stu"
      $s4 = "NBTScanner!y&"
   condition:
      all of them
}