deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EquationGroup_ewok
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file ewok
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$x1 = "Example: ewok -t target public" fullword ascii
      $x2 = "Usage:  cleaner host community fake_prog" fullword ascii
      $x3 = "-g  - Subset of -m that Green Spirit hits " fullword ascii
      $x4 = "--- ewok version" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 80KB and 1 of them )

Full rule:
rule EquationGroup_ewok {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file ewok"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "567da502d7709b7814ede9c7954ccc13d67fc573f3011db04cf212f8e8a95d72"
      id = "379c233f-86f8-5116-a15c-8a80b27daea6"
   strings:
      $x1 = "Example: ewok -t target public" fullword ascii
      $x2 = "Usage:  cleaner host community fake_prog" fullword ascii
      $x3 = "-g  - Subset of -m that Green Spirit hits " fullword ascii
      $x4 = "--- ewok version" fullword ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 80KB and 1 of them )
}
YARA Detection Rule: EquationGroup_xspy
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file xspy
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$s1 = "USAGE: xspy -display <display> -delay <usecs> -up" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 60KB and all of them )

Full rule:
rule EquationGroup_xspy {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file xspy"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "841e065c9c340a1e522b281a39753af8b6a3db5d9e7d8f3d69e02fdbd662f4cf"
      id = "fcb7246a-d613-51d7-a4f7-f767fa5f79e1"
   strings:
      $s1 = "USAGE: xspy -display <display> -delay <usecs> -up" fullword ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 60KB and all of them )
}
YARA Detection Rule: EquationGroup_estesfox
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file estesfox
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$x1 = "chown root:root x;chmod 4777 x`' /tmp/logwatch.$2/cron" fullword ascii

Detection condition:
all of them

Full rule:
rule EquationGroup_estesfox {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file estesfox"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "33530cae130ee9d9deeee60df9292c00242c0fe6f7b8eedef8ed09881b7e1d5a"
      id = "f2e8b8ba-af09-5e7c-a99c-4f620a0917c9"
   strings:
      $x1 = "chown root:root x;chmod 4777 x`' /tmp/logwatch.$2/cron" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: EquationGroup_elatedmonkey_1_0_1_1
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file elatedmonkey.1.0.1.1.sh
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$s1 = "Usage: $0 ( -s IP PORT | CMD )" fullword ascii
      $s2 = "os.execl(\"/bin/sh\", \"/bin/sh\", \"-c\", \"$CMD\")" fullword ascii
      $s3 = "PHP_SCRIPT=\"$HOME/public_html/info$X.php\"" fullword ascii
      $s4 = "cat > /dev/tcp/127.0.0.1/80 <<" ascii

Detection condition:
filesize < 15KB and 2 of them

Full rule:
rule EquationGroup_elatedmonkey_1_0_1_1 {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file elatedmonkey.1.0.1.1.sh"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      modified = "2022-08-18"
      hash1 = "bf7a9dce326604f0681ca9f7f1c24524543b5be8b6fcc1ba427b18e2a4ff9090"
      id = "d8915305-2ed7-50b7-84d0-b139a6d3481a"
   strings:
      $s1 = "Usage: $0 ( -s IP PORT | CMD )" fullword ascii
      $s2 = "os.execl(\"/bin/sh\", \"/bin/sh\", \"-c\", \"$CMD\")" fullword ascii
      $s3 = "PHP_SCRIPT=\"$HOME/public_html/info$X.php\"" fullword ascii
      $s4 = "cat > /dev/tcp/127.0.0.1/80 <<" ascii
   condition:
      filesize < 15KB and 2 of them
}
YARA Detection Rule: EquationGroup_scanner
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file scanner
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$x1 = "program version netid     address             service         owner" fullword ascii
      $x4 = "*** Sorry about the raw output, I'll leave it for now" fullword ascii
      $x5 = "-scan winn %s one" fullword ascii

Detection condition:
filesize < 250KB and 1 of them

Full rule:
rule EquationGroup_scanner {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file scanner"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "dcbcd8a98ec93a4e877507058aa26f0c865b35b46b8e6de809ed2c4b3db7e222"
      id = "b2f9c534-0ca7-5223-b85e-8e74c3cfa6ff"
   strings:
      $x1 = "program version netid     address             service         owner" fullword ascii
      $x4 = "*** Sorry about the raw output, I'll leave it for now" fullword ascii
      $x5 = "-scan winn %s one" fullword ascii
   condition:
      filesize < 250KB and 1 of them
}
YARA Detection Rule: EquationGroup__ftshell_ftshell_v3_10_3_0
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- from files ftshell, ftshell.v3.10.3.7
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$s1 = "set uRemoteUploadCommand \"[exec cat /current/.ourtn-ftshell-upcommand]\"" fullword ascii
      $s2 = "send \"\\[ \\\"\\$BASH\\\" = \\\"/bin/bash\\\" -o \\\"\\$SHELL\\\" = \\\"/bin/bash\\\" \\] &&" ascii
      $s3 = "system rm -f /current/tmp/ftshell.latest" fullword ascii
      $s4 = "# ftshell -- File Transfer Shell" fullword ascii

Detection condition:
( uint16(0) == 0x2123 and filesize < 100KB and 1 of them ) or ( 2 of them )

Full rule:
rule EquationGroup__ftshell_ftshell_v3_10_3_0 {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- from files ftshell, ftshell.v3.10.3.7"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      super_rule = 1
      hash1 = "9bebeb57f1c9254cb49976cc194da4be85da4eb94475cb8d813821fb0b24f893"
      hash2 = "0be739024b41144c3b63e40e46bab22ac098ccab44ab2e268efc3b63aea02951"
      id = "6a2db0a0-386f-5ea6-b0bc-e28ed2fd53d5"
   strings:
      $s1 = "set uRemoteUploadCommand \"[exec cat /current/.ourtn-ftshell-upcommand]\"" fullword ascii
      $s2 = "send \"\\[ \\\"\\$BASH\\\" = \\\"/bin/bash\\\" -o \\\"\\$SHELL\\\" = \\\"/bin/bash\\\" \\] &&" ascii
      $s3 = "system rm -f /current/tmp/ftshell.latest" fullword ascii
      $s4 = "# ftshell -- File Transfer Shell" fullword ascii
   condition:
      ( uint16(0) == 0x2123 and filesize < 100KB and 1 of them ) or ( 2 of them )
}
YARA Detection Rule: EquationGroup__scanner_scanner_v2_1_2
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- from files scanner, scanner.v2.1.2
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$s1 = "Welcome to the network scanning tool" fullword ascii
      $s2 = "Scanning port %d" fullword ascii
      $s3 = "/current/down/cmdout/scans" fullword ascii
      $s4 = "Scan for SSH version" fullword ascii
      $s5 = "program vers proto   port  service" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 100KB and 2 of them ) or ( all of them )

Full rule:
rule EquationGroup__scanner_scanner_v2_1_2 {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- from files scanner, scanner.v2.1.2"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      super_rule = 1
      hash1 = "dcbcd8a98ec93a4e877507058aa26f0c865b35b46b8e6de809ed2c4b3db7e222"
      hash2 = "9807aaa7208ed6c5da91c7c30ca13d58d16336ebf9753a5cea513bcb59de2cff"
      id = "bf1f2119-f742-5106-96f0-de88755275ef"
   strings:
      $s1 = "Welcome to the network scanning tool" fullword ascii
      $s2 = "Scanning port %d" fullword ascii
      $s3 = "/current/down/cmdout/scans" fullword ascii
      $s4 = "Scan for SSH version" fullword ascii
      $s5 = "program vers proto   port  service" fullword ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 100KB and 2 of them ) or ( all of them )
}
YARA Detection Rule: EquationGroup__ghost_sparc_ghost_x86_3
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- from files ghost_sparc, ghost_x86
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$x1 = "Usage: %s [-v os] [-p] [-r] [-c command] [-a attacker] target" fullword ascii
      $x2 = "Sending shellcode as part of an open command..." fullword ascii
      $x3 = "cmdshellcode" fullword ascii
      $x4 = "You will not be able to run the shellcode. Exiting..." fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 70KB and 1 of them ) or ( 2 of them )

Full rule:
rule EquationGroup__ghost_sparc_ghost_x86_3 {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- from files ghost_sparc, ghost_x86"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      super_rule = 1
      hash1 = "d5ff0208d9532fc0c6716bd57297397c8151a01bf4f21311f24e7a72551f9bf1"
      hash2 = "82c899d1f05b50a85646a782cddb774d194ef85b74e1be642a8be2c7119f4e33"
      id = "ccc9c9be-8f78-5071-a11e-47f994cf8f08"
   strings:
      $x1 = "Usage: %s [-v os] [-p] [-r] [-c command] [-a attacker] target" fullword ascii
      $x2 = "Sending shellcode as part of an open command..." fullword ascii
      $x3 = "cmdshellcode" fullword ascii
      $x4 = "You will not be able to run the shellcode. Exiting..." fullword ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 70KB and 1 of them ) or ( 2 of them )
}
YARA Detection Rule: EquationGroup__pclean_v2_1_1_pclean_v2_1_1_4
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- from files pclean.v2.1.1.0-linux-i386, pclean.v2.1.1.0-linux-x86_64
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$s1 = "-c cmd_name:     strncmp() search for 1st %d chars of commands that " fullword ascii
      $s2 = "e.g.: -n 1-1024,1080,6666,31337 " fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 50KB and all of them )

Full rule:
rule EquationGroup__pclean_v2_1_1_pclean_v2_1_1_4 {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- from files pclean.v2.1.1.0-linux-i386, pclean.v2.1.1.0-linux-x86_64"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      super_rule = 1
      hash1 = "cdb5b1173e6eb32b5ea494c38764b9975ddfe83aa09ba0634c4bafa41d844c97"
      hash2 = "ab7f26faed8bc2341d0517d9cb2bbf41795f753cd21340887fc2803dc1b9a1dd"
      id = "ed4a3b3a-0935-533b-80dd-ee23b2e8df00"
   strings:
      $s1 = "-c cmd_name:     strncmp() search for 1st %d chars of commands that " fullword ascii
      $s2 = "e.g.: -n 1-1024,1080,6666,31337 " fullword ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 50KB and all of them )
}
YARA Detection Rule: EquationGroup__jparsescan_parsescan_5
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- from files jparsescan, parsescan
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$s1 = "# default is to dump out all scanned hosts found" fullword ascii
      $s2 = "$bool .= \" -r \" if (/mibiisa.* -r/);" fullword ascii
      $s3 = "sadmind is available on two ports, this also works)" fullword ascii
      $s4 = "-x IP      gives \\\"hostname:# users:load ...\\\" if positive xwin scan" fullword ascii

Detection condition:
( uint16(0) == 0x2123 and filesize < 40KB and 1 of them ) or ( 2 of them )

Full rule:
rule EquationGroup__jparsescan_parsescan_5 {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- from files jparsescan, parsescan"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      super_rule = 1
      hash1 = "8c248eec0af04300f3ba0188fe757850d283de84cf42109638c1c1280c822984"
      hash2 = "942c12067b0afe9ebce50aa9dfdbf64e6ed0702d9a3a00d25b4fca62a38369ef"
      id = "964a4e49-9163-5dd6-bb2c-88fa39d5f356"
   strings:
      $s1 = "# default is to dump out all scanned hosts found" fullword ascii
      $s2 = "$bool .= \" -r \" if (/mibiisa.* -r/);" fullword ascii
      $s3 = "sadmind is available on two ports, this also works)" fullword ascii
      $s4 = "-x IP      gives \\\"hostname:# users:load ...\\\" if positive xwin scan" fullword ascii
   condition:
      ( uint16(0) == 0x2123 and filesize < 40KB and 1 of them ) or ( 2 of them )
}
YARA Detection Rule: EquationGroup__funnelout_v4_1_0_1
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- from files funnelout.v4.1.0.1.pl
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$s1 = "header(\"Set-Cookie: bbsessionhash=\" . \\$hash . \"; path=/; HttpOnly\");" fullword ascii
      $s2 = "if ($code =~ /proxyhost/) {" fullword ascii
      $s3 = "\\$rk[1] = \\$rk[1] - 1;" ascii
      $s4 = "#existsUser($u) or die \"User '$u' does not exist in database.\\n\";" fullword ascii

Detection condition:
( uint16(0) == 0x2123 and filesize < 100KB and 2 of them ) or ( all of them )

Full rule:
rule EquationGroup__funnelout_v4_1_0_1 {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- from files funnelout.v4.1.0.1.pl"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      super_rule = 1
      hash2 = "457ed14e806fdbda91c4237c8dc058c55e5678f1eecdd78572eff6ca0ed86d33"
      id = "b0c42b06-8314-5731-b333-59bb90785cf4"
   strings:
      $s1 = "header(\"Set-Cookie: bbsessionhash=\" . \\$hash . \"; path=/; HttpOnly\");" fullword ascii
      $s2 = "if ($code =~ /proxyhost/) {" fullword ascii
      $s3 = "\\$rk[1] = \\$rk[1] - 1;" ascii
      $s4 = "#existsUser($u) or die \"User '$u' does not exist in database.\\n\";" fullword ascii
   condition:
      ( uint16(0) == 0x2123 and filesize < 100KB and 2 of them ) or ( all of them )
}
YARA Detection Rule: EquationGroup__magicjack_v1_1_0_0_client
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- from files magicjack_v1.1.0.0_client-1.1.0.0.py
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$s1 = "temp = ((left >> 1) ^ right) & 0x55555555" fullword ascii
      $s2 = "right ^= (temp <<  16) & 0xffffffff" fullword ascii
      $s3 = "tempresult = \"\"" fullword ascii
      $s4 = "num = self.bytes2long(data)" fullword ascii

Detection condition:
( uint16(0) == 0x2123 and filesize < 80KB and 3 of them ) or ( all of them )

Full rule:
rule EquationGroup__magicjack_v1_1_0_0_client {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- from files magicjack_v1.1.0.0_client-1.1.0.0.py"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      super_rule = 1
      hash1 = "63292a2353275a3bae012717bb500d5169cd024064a1ce8355ecb4e9bfcdfdd1"
      id = "be18f36c-3d6c-53a3-89b6-bfc53e1dd87d"
   strings:
      $s1 = "temp = ((left >> 1) ^ right) & 0x55555555" fullword ascii
      $s2 = "right ^= (temp <<  16) & 0xffffffff" fullword ascii
      $s3 = "tempresult = \"\"" fullword ascii
      $s4 = "num = self.bytes2long(data)" fullword ascii
   condition:
      ( uint16(0) == 0x2123 and filesize < 80KB and 3 of them ) or ( all of them )
}
YARA Detection Rule: EquationGroup__ftshell
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- from files ftshell, ftshell.v3.10.3.7
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$s1 = "if { [string length $uRemoteUploadCommand]" fullword ascii
      $s2 = "processUpload" fullword ascii
      $s3 = "global dothisreallyquiet" fullword ascii

Detection condition:
( uint16(0) == 0x2123 and filesize < 100KB and 2 of them ) or ( all of them )

Full rule:
rule EquationGroup__ftshell {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- from files ftshell, ftshell.v3.10.3.7"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      super_rule = 1
      hash1 = "9bebeb57f1c9254cb49976cc194da4be85da4eb94475cb8d813821fb0b24f893"
      hash4 = "0be739024b41144c3b63e40e46bab22ac098ccab44ab2e268efc3b63aea02951"
      id = "6a2db0a0-386f-5ea6-b0bc-e28ed2fd53d5"
   strings:
      $s1 = "if { [string length $uRemoteUploadCommand]" fullword ascii
      $s2 = "processUpload" fullword ascii
      $s3 = "global dothisreallyquiet" fullword ascii
   condition:
      ( uint16(0) == 0x2123 and filesize < 100KB and 2 of them ) or ( all of them )
}
YARA Detection Rule: EquationGroup_store_linux_i386_v_3_3_0
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool set
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$s1 = "[-] Failed to map file: %s" fullword ascii
      $s2 = "[-] can not NULL terminate input data" fullword ascii
      $s3 = "[!] Name has size of 0!" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 60KB and all of them )

Full rule:
rule EquationGroup_store_linux_i386_v_3_3_0 {
   meta:
      description = "Equation Group hack tool set"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-09"
      hash1 = "abc27fda9a0921d7cf2863c29768af15fdfe47a0b3e7a131ef7e5cc057576fbc"
      id = "b88be148-5308-583a-b41e-2bea9b837e2a"
   strings:
      $s1 = "[-] Failed to map file: %s" fullword ascii
      $s2 = "[-] can not NULL terminate input data" fullword ascii
      $s3 = "[!] Name has size of 0!" fullword ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 60KB and all of them )
}
YARA Detection Rule: EquationGroup_morerats_client_genkey
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool set
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$x1 = "rsakey_txt = lo_execute('openssl genrsa 2048 2> /dev/null | openssl rsa -text 2> /dev/null')" fullword ascii
      $x2 = "client_auth = binascii.hexlify(lo_execute('openssl rand 16'))" fullword ascii

Detection condition:
( filesize < 3KB and all of them )

Full rule:
rule EquationGroup_morerats_client_genkey {
   meta:
      description = "Equation Group hack tool set"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-09"
      hash1 = "0ce455fb7f46e54a5db9bef85df1087ff14d2fc60a88f2becd5badb9c7fe3e89"
      id = "fb305be7-9e16-502e-89ca-a40bb6890404"
   strings:
      $x1 = "rsakey_txt = lo_execute('openssl genrsa 2048 2> /dev/null | openssl rsa -text 2> /dev/null')" fullword ascii
      $x2 = "client_auth = binascii.hexlify(lo_execute('openssl rand 16'))" fullword ascii
   condition:
      ( filesize < 3KB and all of them )
}
YARA Detection Rule: EquationGroup_cursetingle_2_0_1_2_mswin32_v_2_0_1
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool set
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$s1 = "[%.2u%.2u%.2u%.2u%.2u%.2u]" fullword ascii
      $s2 = "[PII_REDACTED]abcdefABCEDF:" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and all of them )

Full rule:
rule EquationGroup_cursetingle_2_0_1_2_mswin32_v_2_0_1 {
   meta:
      description = "Equation Group hack tool set"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-09"
      hash1 = "614bf159b956f20d66cedf25af7503b41e91841c75707af0cdf[PII_REDACTED]a61"
      id = "7a1870ba-d600-5c11-8d3d-41395ad8be63"
   strings:
      $s1 = "[%.2u%.2u%.2u%.2u%.2u%.2u]" fullword ascii
      $s2 = "[PII_REDACTED]abcdefABCEDF:" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
}