deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: CheshireCat_Gen2
Repository: Neo23x0/signature-base
Detects: Cheshire Cat Malware
Author: Florian Roth (Nextron Systems)
Reference: https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/

Pattern signatures:
$a1 = "Interface\\%s\\info" fullword ascii
		$a2 = "Interface\\%s\\info\\%s" fullword ascii
		$a3 = "CLSID\\%s\\info\\%s" fullword ascii
		$a4 = "CLSID\\%s\\info" fullword ascii

		$b1 = "Windows Shell Icon Handler" fullword wide
		$b2 = "Microsoft Shell Icon Handler" fullword wide

		$s1 = "\\StringFileInfo\\%s\\FileVersion" ascii
		$s2 = "CLSID\\%s\\AuxCLSID" fullword ascii
		$s3 = "lnkfile\\shellex\\IconHandler" fullword ascii
		$s4 = "%s: %s, %.2hu %s %hu %2.2hu:%2.2hu:%2.2hu GMT" fullword ascii
		$s5 = "%sMutex" fullword ascii
		$s6 = "\\ShellIconCache" ascii
		$s7 = "+6Service Pack " fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and 7 of ($s*) and 2 of ($a*) and 1 of ($b*)

Full rule:
rule CheshireCat_Gen2 {
	meta:
		description = "Cheshire Cat Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
		date = "2015-08-08"
		super_rule = 1
		score = 70
		hash1 = "ec41b029c3ff4147b6a5252cb8b659f851f4538d4af0a574f7e16bc1cd14a300"
		hash2 = "32159d2a16397823bc882ddd3cd77ecdbabe0fde934e62f297b8ff4d7b89832a"
		hash3 = "63735d555f219765d486b3d253e39bd316bbcb1c0ec595ea45ddf6e419bef3cb"
		hash4 = "c074aeef97ce81e8c68b7376b124546cabf40e2cd3aff1719d9daa6c3f780532"
		id = "b97b20bd-f6b9-512f-ba99-6c38ba7853be"
	strings:
		$a1 = "Interface\\%s\\info" fullword ascii
		$a2 = "Interface\\%s\\info\\%s" fullword ascii
		$a3 = "CLSID\\%s\\info\\%s" fullword ascii
		$a4 = "CLSID\\%s\\info" fullword ascii

		$b1 = "Windows Shell Icon Handler" fullword wide
		$b2 = "Microsoft Shell Icon Handler" fullword wide

		$s1 = "\\StringFileInfo\\%s\\FileVersion" ascii
		$s2 = "CLSID\\%s\\AuxCLSID" fullword ascii
		$s3 = "lnkfile\\shellex\\IconHandler" fullword ascii
		$s4 = "%s: %s, %.2hu %s %hu %2.2hu:%2.2hu:%2.2hu GMT" fullword ascii
		$s5 = "%sMutex" fullword ascii
		$s6 = "\\ShellIconCache" ascii
		$s7 = "+6Service Pack " fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and 7 of ($s*) and 2 of ($a*) and 1 of ($b*)
}
YARA Detection Rule: EXPL_LOG_Cacti_CommandInjection_CVE_2022_46169_Dec22_1
Repository: Neo23x0/signature-base
Detects: Detects potential exploitation attempts that target the Cacti Command Injection CVE-2022-46169
Author: Nasreddine Bencherchali
Reference: https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf

Pattern signatures:
$xr1 = /\/remote_agent\.php.{1,300}(whoami|\/bin\/bash|\/bin\/sh|\bwget\b|powershell|cmd \/c|cmd\.exe \/c).{1,300} 200 / ascii

Detection condition:
$xr1

Full rule:
rule EXPL_LOG_Cacti_CommandInjection_CVE_2022_46169_Dec22_1 {
   meta:
      description = "Detects potential exploitation attempts that target the Cacti Command Injection CVE-2022-46169"
      author = "Nasreddine Bencherchali"
      score = 70
      reference = "https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf"
      date = "2022-12-27"
      id = "c799a419-87ed-55ea-8ebb-d4da901be4ad"
   strings:
      $xr1 = /\/remote_agent\.php.{1,300}(whoami|\/bin\/bash|\/bin\/sh|\bwget\b|powershell|cmd \/c|cmd\.exe \/c).{1,300} 200 / ascii
   condition:
      $xr1
}
YARA Detection Rule: Shamoon2_Wiper
Repository: Neo23x0/signature-base
Detects: Detects Shamoon 2.0 Wiper Component
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/jKIfGB

Pattern signatures:
$a1 = "\\??\\%s\\System32\\%s.exe" fullword wide
      $x1 = "IWHBWWHVCIDBRAFUASIIWURRTWRTIBIVJDGWTRRREFDEAEBIAEBJGGCSVUHGVJUHADIEWAFGWADRUWDTJBHTSITDVVBCIDCWHRHVTDVCDESTHWSUAEHGTWTJWFIRTBRB" wide
      $s1 = "UFWYNYNTS" fullword wide
      $s2 = "\\\\?\\ElRawDisk" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them ) or ( 3 of them )

Full rule:
rule Shamoon2_Wiper {
   meta:
      description = "Detects Shamoon 2.0 Wiper Component"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/jKIfGB"
      date = "2016-12-01"
      score = 70
      hash1 = "c7fc1f9c2bed748b50a599ee2fa609eb7c9ddaeb9cd16633ba0d10cf66891d8a"
      hash2 = "128fa5815c6fee68463b18051c1a1ccdf28c599ce321691686b1efa4838a2acd"
      id = "6660a64c-daa4-59e6-aa65-55194cac600c"
   strings:
      $a1 = "\\??\\%s\\System32\\%s.exe" fullword wide
      $x1 = "IWHBWWHVCIDBRAFUASIIWURRTWRTIBIVJDGWTRRREFDEAEBIAEBJGGCSVUHGVJUHADIEWAFGWADRUWDTJBHTSITDVVBCIDCWHRHVTDVCDESTHWSUAEHGTWTJWFIRTBRB" wide
      $s1 = "UFWYNYNTS" fullword wide
      $s2 = "\\\\?\\ElRawDisk" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them ) or ( 3 of them )
}
YARA Detection Rule: Shamoon2_ComComp
Repository: Neo23x0/signature-base
Detects: Detects Shamoon 2.0 Communication Components
Author: Florian Roth (Nextron Systems) (with Binar.ly)
Reference: https://goo.gl/jKIfGB

Pattern signatures:
$s1 = "mkdir %s%s > nul 2>&1" fullword ascii
      $s2 = "p[%s%s%d.%s" fullword ascii

      $op1 = { 04 32 cb 88 04 37 88 4c 37 01 88 54 37 02 83 c6 }
      $op2 = { c8 02 d2 c0 e9 06 02 d2 24 3f 02 d1 88 45 fb 8d }
      $op3 = { 0c 3b 40 8d 4e 01 47 3b c1 7c d8 83 fe 03 7d 1c }

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and ( all of ($s*) or all of ($op*) )

Full rule:
rule Shamoon2_ComComp {
   meta:
      description = "Detects Shamoon 2.0 Communication Components"
      author = "Florian Roth (Nextron Systems) (with Binar.ly)"
      reference = "https://goo.gl/jKIfGB"
      date = "2016-12-01"
      score = 70
      hash1 = "61c1c8fc8b268127751ac565ed4abd6bdab8d2d0f2ff6074291b2d54b0228842"
      id = "72068264-4f71-59fb-b3d8-938285ec8c7f"
   strings:
      $s1 = "mkdir %s%s > nul 2>&1" fullword ascii
      $s2 = "p[%s%s%d.%s" fullword ascii

      $op1 = { 04 32 cb 88 04 37 88 4c 37 01 88 54 37 02 83 c6 }
      $op2 = { c8 02 d2 c0 e9 06 02 d2 24 3f 02 d1 88 45 fb 8d }
      $op3 = { 0c 3b 40 8d 4e 01 47 3b c1 7c d8 83 fe 03 7d 1c }
   condition:
      uint16(0) == 0x5a4d and filesize < 500KB and ( all of ($s*) or all of ($op*) )
}
YARA Detection Rule: EldoS_RawDisk
Repository: Neo23x0/signature-base
Detects: EldoS Rawdisk Device Driver (Commercial raw disk access driver - used in Operation Shamoon 2.0)
Author: Florian Roth (Nextron Systems) (with Binar.ly)
Reference: https://goo.gl/jKIfGB

Pattern signatures:
$s1 = "g\\system32\\" wide
      $s2 = "ztvttw" fullword wide
      $s3 = "lwizvm" fullword ascii
      $s4 = "FEJIKC" fullword ascii
      $s5 = "INZQND" fullword ascii
      $s6 = "IUTLOM" fullword wide
      $s7 = "DKFKCK" fullword ascii

      $op1 = { 94 35 77 73 03 40 eb e9 }
      $op2 = { 80 7c 41 01 00 74 0a 3d }
      $op3 = { 74 0a 3d 00 94 35 77 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and 4 of them )

Full rule:
rule EldoS_RawDisk {
   meta:
      description = "EldoS Rawdisk Device Driver (Commercial raw disk access driver - used in Operation Shamoon 2.0)"
      author = "Florian Roth (Nextron Systems) (with Binar.ly)"
      reference = "https://goo.gl/jKIfGB"
      date = "2016-12-01"
      modified = "2023-01-27"
      score = 50
      hash1 = "47bb36cd2832a18b5ae951cf5a7d44fba6d8f5dca0a372392d40f51d1fe1ac34"
      hash2 = "394a7ebad5dfc13d6c75945a61063470dc3b68f7a207613b79ef000e1990909b"
      id = "8a43f425-86b7-5a05-b7c3-13c78aa905f8"
   strings:
      $s1 = "g\\system32\\" wide
      $s2 = "ztvttw" fullword wide
      $s3 = "lwizvm" fullword ascii
      $s4 = "FEJIKC" fullword ascii
      $s5 = "INZQND" fullword ascii
      $s6 = "IUTLOM" fullword wide
      $s7 = "DKFKCK" fullword ascii

      $op1 = { 94 35 77 73 03 40 eb e9 }
      $op2 = { 80 7c 41 01 00 74 0a 3d }
      $op3 = { 74 0a 3d 00 94 35 77 }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and 4 of them )
}
YARA Detection Rule: Gen_Trojan_Mikey
Repository: Neo23x0/signature-base
Detects: Trojan Mikey - file sample_mikey.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\ERAWTFOS" fullword ascii 
						/* reversed string 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' */
		$x1 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
		$x2 = "User-Agent:Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.0; MyIE 3.01)" fullword ascii
		$x3 = "%d*%u%s" fullword ascii
		$x4 = "%s %s:%d" fullword ascii
		$x5 = "Mnopqrst Vwxyabcde Ghijklm Opqrstuv Xya" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and $s0 and 2 of ($x*)

Full rule:
rule Gen_Trojan_Mikey {
	meta:
		description = "Trojan Mikey - file sample_mikey.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015-05-07"
		hash = "a8e6c3ca056b3ff2495d7728654b780735b3a4cb"
		score = 70
		id = "ff875436-4fed-5f20-a0a5-bfd146d93499"
	strings:
		$s0 = "nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\ERAWTFOS" fullword ascii 
						/* reversed string 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' */
		$x1 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
		$x2 = "User-Agent:Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.0; MyIE 3.01)" fullword ascii
		$x3 = "%d*%u%s" fullword ascii
		$x4 = "%s %s:%d" fullword ascii
		$x5 = "Mnopqrst Vwxyabcde Ghijklm Opqrstuv Xya" fullword ascii
	condition:
		uint16(0) == 0x5a4d and $s0 and 2 of ($x*)
}
YARA Detection Rule: BluenoroffPoS_DLL
Repository: Neo23x0/signature-base
Detects: Bluenoroff POS malware - hkp.dll
Author: http://blog.trex.re.kr/
Reference: http://blog.trex.re.kr/3?category=737685

Pattern signatures:
$dll = "ksnetadsl.dll" ascii wide fullword nocase
      $exe = "xplatform.exe" ascii wide fullword nocase
      $agent = "Nimo Software HTTP Retriever 1.0" ascii wide nocase
      $log_file = "c:\\windows\\temp\\log.tmp" ascii wide nocase
      $base_addr = "%d-BaseAddr:0x%x" ascii wide nocase
      $func_addr = "%d-FuncAddr:0x%x" ascii wide nocase
      $HF_S = "HF-S(%d)" ascii wide
      $HF_T = "HF-T(%d)" ascii wide

Detection condition:
5 of them

Full rule:
rule BluenoroffPoS_DLL {
   meta:
      description = "Bluenoroff POS malware - hkp.dll"
      author = "http://blog.trex.re.kr/"
      reference = "http://blog.trex.re.kr/3?category=737685"
      date = "2018-06-07"
      id = "d2b34b50-c7eb-5852-ba5d-734dd5038c2e"
   strings:
      $dll = "ksnetadsl.dll" ascii wide fullword nocase
      $exe = "xplatform.exe" ascii wide fullword nocase
      $agent = "Nimo Software HTTP Retriever 1.0" ascii wide nocase
      $log_file = "c:\\windows\\temp\\log.tmp" ascii wide nocase
      $base_addr = "%d-BaseAddr:0x%x" ascii wide nocase
      $func_addr = "%d-FuncAddr:0x%x" ascii wide nocase
      $HF_S = "HF-S(%d)" ascii wide
      $HF_T = "HF-T(%d)" ascii wide
   condition:
      5 of them
}
YARA Detection Rule: Foudre_Backdoor_1
Repository: Neo23x0/signature-base
Detects: Detects Foudre Backdoor
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/Nbqbt6

Pattern signatures:
$s1 = "initialization failed: Reinstall the program" fullword wide
      $s2 = "SnailDriver V1" fullword wide
      $s3 = "lp.ini" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and 2 of them )

Full rule:
rule Foudre_Backdoor_1 {
   meta:
      description = "Detects Foudre Backdoor"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/Nbqbt6"
      date = "2017-08-01"
      hash1 = "7e73a727dc8f3c48e58468c3fd0a193a027d085f25fa274a6e187cf503f01f74"
      hash2 = "7ce2c5111e3560aa6036f98b48ceafe83aa1ac3d3b[PII_REDACTED]6c859970f8bc"
      id = "ab2d43f4-fc35-5980-9b5d-98c5c4cfd012"
   strings:
      $s1 = "initialization failed: Reinstall the program" fullword wide
      $s2 = "SnailDriver V1" fullword wide
      $s3 = "lp.ini" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and 2 of them )
}
YARA Detection Rule: Foudre_Backdoor_Dropper_1
Repository: Neo23x0/signature-base
Detects: Detects Foudre Backdoor
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/Nbqbt6

Pattern signatures:
$x1 = "536F594A96C5496CB3949A4DA4775B576E049C57696E646F77735C[PII_REDACTED]6E[PII_REDACTED]696F6E5C5C52756E" fullword wide
      $x2 = "[PII_REDACTED]C380B[PII_REDACTED]482EC32" fullword wide

      $s1 = "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\\\Startup\\" wide
      $s2 = "C:\\Documents and Settings\\All Users\\" wide
      $s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\\\Shell Folders" wide
      $s4 = "ShellExecuteW" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of ($x*) or 4 of them ) )

Full rule:
rule Foudre_Backdoor_Dropper_1 {
   meta:
      description = "Detects Foudre Backdoor"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/Nbqbt6"
      date = "2017-08-01"
      modified = "2023-01-07"
      hash1 = "6bc9f6ac2f6688ed63baa29913eaf8c64738cf19933d974d25a0c26b7d01b9ac"
      hash2 = "da228831089c56743d1fbc8ef156c672017cdf46a322d847a270b9907def53a5"
      id = "38c7d05b-d545-53c5-8db7-a7925b5b7838"
   strings:
      $x1 = "536F594A96C5496CB3949A4DA4775B576E049C57696E646F77735C[PII_REDACTED]6E[PII_REDACTED]696F6E5C5C52756E" fullword wide
      $x2 = "[PII_REDACTED]C380B[PII_REDACTED]482EC32" fullword wide

      $s1 = "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\\\Startup\\" wide
      $s2 = "C:\\Documents and Settings\\All Users\\" wide
      $s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\\\Shell Folders" wide
      $s4 = "ShellExecuteW" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of ($x*) or 4 of them ) )
}
YARA Detection Rule: Foudre_Backdoor_Component_1
Repository: Neo23x0/signature-base
Detects: Detects Foudre Backdoor
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/Nbqbt6

Pattern signatures:
/* $s1 = "Project1.dll" fullword ascii */
      /* Better: Project1.dll\x00D1 */
      $s1 = { 50 72 6F 6A 65 63 74 31 2E 64 6C 6C 00 44 31 }
      $s2 = "winmgmts:\\\\localhost\\root\\SecurityCenter2" fullword wide
      $s3 = "C:\\Documents and Settings\\All Users\\" wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and
         ( 3 of them ) or
         ( 2 of them and pe.exports("D1") )
      )

Full rule:
rule Foudre_Backdoor_Component_1 {
   meta:
      description = "Detects Foudre Backdoor"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/Nbqbt6"
      date = "2017-08-01"
      modified = "2023-01-07"
      hash1 = "7c6206eaf0c5c9c6c8d8586a626b[PII_REDACTED]2c51458575e51cba72ba2096a4"
      hash2 = "db605d501d3a5ca2b0e3d8296d552fbbf048ee831be21efca407c45bf794b109"
      id = "9070f581-64a7-5620-aff4-7f2cbd73099d"
   strings:
      /* $s1 = "Project1.dll" fullword ascii */
      /* Better: Project1.dll\x00D1 */
      $s1 = { 50 72 6F 6A 65 63 74 31 2E 64 6C 6C 00 44 31 }
      $s2 = "winmgmts:\\\\localhost\\root\\SecurityCenter2" fullword wide
      $s3 = "C:\\Documents and Settings\\All Users\\" wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and
         ( 3 of them ) or
         ( 2 of them and pe.exports("D1") )
      )
}
YARA Detection Rule: Foudre_Backdoor_SFX
Repository: Neo23x0/signature-base
Detects: Detects Foudre Backdoor SFX
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/Nbqbt6

Pattern signatures:
$s1 = "main.exe" fullword ascii
      $s2 = "pub.key" fullword ascii
      $s3 = "WinRAR self-extracting archive" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )

Full rule:
rule Foudre_Backdoor_SFX {
   meta:
      description = "Detects Foudre Backdoor SFX"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/Nbqbt6"
      date = "2017-08-01"
      hash1 = "2b37ce9e31625d8b9e51b88418d4bf38ed28c77d98ca59a09daab01be36d405a"
      hash2 = "4d51a0ea4ecc[PII_REDACTED]3ff135e4d94d5899c4de749621bafcedbf4417c472"
      id = "b5c7cd6b-48c8-5703-b695-19d226de1810"
   strings:
      $s1 = "main.exe" fullword ascii
      $s2 = "pub.key" fullword ascii
      $s3 = "WinRAR self-extracting archive" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
}
YARA Detection Rule: APT_MAL_MalDoc_CloudAtlas_Oct20_1
Repository: Neo23x0/signature-base
Detects: Detects unknown maldoc dropper noticed in October 2020
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/jfslowik/status/[PII_REDACTED]92651009

Pattern signatures:
$x1 = "https://msofficeupdate.org" wide

Detection condition:
uint16(0) == 0xcfd0 and
      filesize < 300KB and
      1 of ($x*)

Full rule:
rule APT_MAL_MalDoc_CloudAtlas_Oct20_1 {
   meta:
      description = "Detects unknown maldoc dropper noticed in October 2020"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/jfslowik/status/[PII_REDACTED]92651009"
      date = "2020-10-13"
      hash1 = "7ba76b2311736dbcd4f2817c40dae78f223366f2404571cd16d6676c7a640d70"
      id = "e7caf2b2-caf2-5984-a792-8224f2641bda"
   strings:
      $x1 = "https://msofficeupdate.org" wide
   condition:
      uint16(0) == 0xcfd0 and
      filesize < 300KB and
      1 of ($x*)
}
YARA Detection Rule: APT_MAL_URL_CloudAtlas_Oct20_2
Repository: Neo23x0/signature-base
Detects: Detects unknown maldoc dropper noticed in October 2020 - file morgue6visible5bunny6culvert7ambo5nun1illuminate4.url
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/jfslowik/status/[PII_REDACTED]92651009

Pattern signatures:
/* [InternetShortcut]
         URL=https://msofficeupdate.org/ */
      $hc1 = { 5B 49 6E 74 65 72 6E 65 74 53 68 6F 72 74 63 75
               74 5D 0D 0A 55 52 4C 3D 68 74 74 70 73 3A 2F 2F
               6D 73 6F 66 66 69 63 65 75 70 64 61 74 65 2E 6F
               72 67 }

Detection condition:
uint16(0) == 0x495b and
      filesize < 200 and
      $hc1 at 0

Full rule:
rule APT_MAL_URL_CloudAtlas_Oct20_2 {
   meta:
      description = "Detects unknown maldoc dropper noticed in October 2020 - file morgue6visible5bunny6culvert7ambo5nun1illuminate4.url"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/jfslowik/status/[PII_REDACTED]92651009"
      date = "2020-10-13"
      hash1 = "a6a58b614a9f5ffa1d90b5d42e15521f52e2295f02c1c0e5cd9cbfe933303bee"
      id = "91f6362f-1793-58a3-a750-04ec9812b9df"
   strings:
      /* [InternetShortcut]
         URL=https://msofficeupdate.org/ */
      $hc1 = { 5B 49 6E 74 65 72 6E 65 74 53 68 6F 72 74 63 75
               74 5D 0D 0A 55 52 4C 3D 68 74 74 70 73 3A 2F 2F
               6D 73 6F 66 66 69 63 65 75 70 64 61 74 65 2E 6F
               72 67 }
   condition:
      uint16(0) == 0x495b and
      filesize < 200 and
      $hc1 at 0
}
YARA Detection Rule: BitPaymer
Repository: Neo23x0/signature-base
Detects: Rule to detect newer Bitpaymer samples. Rule is based on BitPaymer custom packer
Author: Morphisec labs

Pattern signatures:
$opcodes1 = {B9 ?? 00 00 00 FF 14 0F B8 FF 00 00 00 C3 89 45 FC}
      $opcodes2 = {61 55 FF 54 B7 01 B0 FF C9 C3 CC 89 45 FC}

Detection condition:
(uint16 (0) == 0x5a4d) and ($opcodes1 or $opcodes2)

Full rule:
rule BitPaymer {
   meta:
      description = "Rule to detect newer Bitpaymer samples. Rule is based on BitPaymer custom packer"
      author = "Morphisec labs"
      refrence = "http://blog.morphisec.com/bitpaymer-ransomware-with-new-custom-packer-framework"
      id = "916de232-1f1b-5853-a57f-623812cfed16"
   strings:
      $opcodes1 = {B9 ?? 00 00 00 FF 14 0F B8 FF 00 00 00 C3 89 45 FC}
      $opcodes2 = {61 55 FF 54 B7 01 B0 FF C9 C3 CC 89 45 FC}
   condition:
      (uint16 (0) == 0x5a4d) and ($opcodes1 or $opcodes2)
}
YARA Detection Rule: WindowsShell_s3
Repository: Neo23x0/signature-base
Detects: Detects simple Windows shell - file s3.exe
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/odzhan/shells/

Pattern signatures:
$s1 = "cmd                  - execute cmd.exe" fullword ascii
		$s2 = "\\\\.\\pipe\\%08X" fullword ascii
		$s3 = "get <remote> <local> - download file" fullword ascii
		$s4 = "[ simple remote shell for windows v3" fullword ascii
		$s5 = "REMOTE: CreateFile(\"%s\")" fullword ascii
		$s6 = "put <local> <remote> - upload file" fullword ascii
		$s7 = "term                 - terminate remote client" fullword ascii
		$s8 = "[ downloading \"%s\" to \"%s\"" fullword ascii
		$s9 = "-l           Listen for incoming connections" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 150KB and 2 of them ) or ( 5 of them )

Full rule:
rule WindowsShell_s3 {
	meta:
		description = "Detects simple Windows shell - file s3.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/odzhan/shells/"
		date = "2016-03-26"
		hash = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
		id = "064754a7-8639-5dbd-93f3-906662b8e9bc"
	strings:
		$s1 = "cmd                  - execute cmd.exe" fullword ascii
		$s2 = "\\\\.\\pipe\\%08X" fullword ascii
		$s3 = "get <remote> <local> - download file" fullword ascii
		$s4 = "[ simple remote shell for windows v3" fullword ascii
		$s5 = "REMOTE: CreateFile(\"%s\")" fullword ascii
		$s6 = "put <local> <remote> - upload file" fullword ascii
		$s7 = "term                 - terminate remote client" fullword ascii
		$s8 = "[ downloading \"%s\" to \"%s\"" fullword ascii
		$s9 = "-l           Listen for incoming connections" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 150KB and 2 of them ) or ( 5 of them )
}
YARA Detection Rule: WindosShell_s1
Repository: Neo23x0/signature-base
Detects: Detects simple Windows shell - file s1.exe
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/odzhan/shells/

Pattern signatures:
$s1 = "[ executing cmd.exe" fullword ascii
		$s2 = "[ simple remote shell for windows v1" fullword ascii
		$s3 = "-p <number>  Port number to use (default is 443)" fullword ascii
		$s4 = "usage: s1 <address> [options]" fullword ascii
		$s5 = "[ waiting for connections on %s" fullword ascii
		$s6 = "-l           Listen for incoming connections" fullword ascii
		$s7 = "[ connection from %s" fullword ascii
		$s8 = "[ %c%c requires parameter" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 150KB and 2 of them ) or ( 5 of them )

Full rule:
rule WindosShell_s1 {
	meta:
		description = "Detects simple Windows shell - file s1.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/odzhan/shells/"
		date = "2016-03-26"
		hash = "4a397497cfaf91e05a9b9d6fa6e335243cca3f175d5d81296b96c13c624818bd"
		id = "b4e783a2-4a93-5c72-9b09-4692b383ac00"
	strings:
		$s1 = "[ executing cmd.exe" fullword ascii
		$s2 = "[ simple remote shell for windows v1" fullword ascii
		$s3 = "-p <number>  Port number to use (default is 443)" fullword ascii
		$s4 = "usage: s1 <address> [options]" fullword ascii
		$s5 = "[ waiting for connections on %s" fullword ascii
		$s6 = "-l           Listen for incoming connections" fullword ascii
		$s7 = "[ connection from %s" fullword ascii
		$s8 = "[ %c%c requires parameter" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 150KB and 2 of them ) or ( 5 of them )
}