deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: WEBSHELL_CVE_2021_27065_Webshells
Repository: Neo23x0/signature-base
Detects: Detects web shells dropped by CVE-2021-27065. All actors, not specific to HAFNIUM. TLP:WHITE
Author: Joe Hannon, Microsoft Threat Intelligence Center (MSTIC)
Reference: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

Pattern signatures:
$script1 = "script language" ascii wide nocase
      $script2 = "page language" ascii wide nocase
      $script3 = "runat=\"server\"" ascii wide nocase
      $script4 = "/script" ascii wide nocase
      $externalurl = "externalurl" ascii wide nocase
      $internalurl = "internalurl" ascii wide nocase
      $internalauthenticationmethods = "internalauthenticationmethods" ascii wide nocase
      $extendedprotectiontokenchecking = "extendedprotectiontokenchecking" ascii wide nocase

Detection condition:
filesize < 50KB and any of ($script*) and ($externalurl or $internalurl) and $internalauthenticationmethods and $extendedprotectiontokenchecking

Full rule:
rule WEBSHELL_CVE_2021_27065_Webshells {
   meta:
      description = "Detects web shells dropped by CVE-2021-27065. All actors, not specific to HAFNIUM. TLP:WHITE"
      author = "Joe Hannon, Microsoft Threat Intelligence Center (MSTIC)"
      date = "2021-03-05"
      reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
      id = "27677f35-24a3-59cc-a3ad-b83884128da7"
   strings:
      $script1 = "script language" ascii wide nocase
      $script2 = "page language" ascii wide nocase
      $script3 = "runat=\"server\"" ascii wide nocase
      $script4 = "/script" ascii wide nocase
      $externalurl = "externalurl" ascii wide nocase
      $internalurl = "internalurl" ascii wide nocase
      $internalauthenticationmethods = "internalauthenticationmethods" ascii wide nocase
      $extendedprotectiontokenchecking = "extendedprotectiontokenchecking" ascii wide nocase
   condition:
      filesize < 50KB and any of ($script*) and ($externalurl or $internalurl) and $internalauthenticationmethods and $extendedprotectiontokenchecking
}
YARA Detection Rule: APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_3
Repository: Neo23x0/signature-base
Detects: Detects HAFNIUM ASPX files dropped on compromised servers
Author: Florian Roth (Nextron Systems)
Reference: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

Pattern signatures:
$s1 = "runat=\"server\">void Page_Load(object" ascii wide 
      $s2 = "Request.Files[0].SaveAs(Server.MapPath(" ascii wide

Detection condition:
filesize < 50KB and
      all of them

Full rule:
rule APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_3 {
   meta:
      description = "Detects HAFNIUM ASPX files dropped on compromised servers"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
      date = "2021-03-07"
      score = 85
      id = "9c2ba123-63c4-5e9c-a08f-bd9db3304691"
   strings:
      $s1 = "runat=\"server\">void Page_Load(object" ascii wide 
      $s2 = "Request.Files[0].SaveAs(Server.MapPath(" ascii wide
   condition:
      filesize < 50KB and
      all of them
}
YARA Detection Rule: APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_4
Repository: Neo23x0/signature-base
Detects: Detects HAFNIUM ASPX files dropped on compromised servers
Author: Florian Roth (Nextron Systems)
Reference: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

Pattern signatures:
$s1 = "<%@Page Language=\"Jscript\"%>" ascii wide nocase
      $s2 = ".FromBase64String(" ascii wide nocase
      $s3 = "eval(System.Text.Encoding." ascii wide nocase

Detection condition:
filesize < 850 and
      all of them

Full rule:
rule APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_4 {
   meta:
      description = "Detects HAFNIUM ASPX files dropped on compromised servers"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
      date = "2021-03-07"
      score = 85
      id = "93f5b682-642d-5edf-84a9-296bf12cd72b"
   strings:
      $s1 = "<%@Page Language=\"Jscript\"%>" ascii wide nocase
      $s2 = ".FromBase64String(" ascii wide nocase
      $s3 = "eval(System.Text.Encoding." ascii wide nocase
   condition:
      filesize < 850 and
      all of them
}
YARA Detection Rule: APT_HAFNIUM_ForensicArtefacts_WER_Mar21_1
Repository: Neo23x0/signature-base
Detects: Detects a Windows Error Report (WER) that indicates and exploitation attempt of the Exchange server as described in CVE-2021-26857 after the corresponding patches have been applied. WER files won't be written upon successful exploitation before applying the patch. Therefore, this indicates an unsuccessful attempt.
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/cyb3rops/status/[PII_REDACTED]48446976

Pattern signatures:
$s1 = "AppPath=c:\\windows\\system32\\inetsrv\\w3wp.exe" wide fullword
      $s7 = ".Value=w3wp#MSExchangeECPAppPool" wide

Detection condition:
uint16(0) == 0xfeff and
      filesize < 8KB and
      all of them

Full rule:
rule APT_HAFNIUM_ForensicArtefacts_WER_Mar21_1 {
   meta:
      description = "Detects a Windows Error Report (WER) that indicates and exploitation attempt of the Exchange server as described in CVE-2021-26857 after the corresponding patches have been applied. WER files won't be written upon successful exploitation before applying the patch. Therefore, this indicates an unsuccessful attempt."
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/cyb3rops/status/[PII_REDACTED]48446976"
      date = "2021-03-07"
      score = 40
      id = "06771101-10ce-5d6b-99f7-a321aade7f69"
   strings:
      $s1 = "AppPath=c:\\windows\\system32\\inetsrv\\w3wp.exe" wide fullword
      $s7 = ".Value=w3wp#MSExchangeECPAppPool" wide
   condition:
      uint16(0) == 0xfeff and
      filesize < 8KB and
      all of them
}
YARA Detection Rule: APT_HAFNIUM_ForensicArtefacts_Cab_Recon_Mar21_1
Repository: Neo23x0/signature-base
Detects: Detects suspicious CAB files used by HAFNIUM for recon activity
Author: Florian Roth (Nextron Systems)
Reference: https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/3?u=dstepanic

Pattern signatures:
$s1 = "ip.txt" ascii fullword
      $s2 = "arp.txt" ascii fullword
      $s3 = "system" ascii fullword 
      $s4 = "security" ascii fullword

Detection condition:
uint32(0) == 0x4643534d and
      filesize < 10000KB and (
         $s1 in (0..200) and 
         $s2 in (0..200) and
         $s3 in (0..200) and
         $s4 in (0..200)
      )

Full rule:
rule APT_HAFNIUM_ForensicArtefacts_Cab_Recon_Mar21_1 {
   meta:
      description = "Detects suspicious CAB files used by HAFNIUM for recon activity"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/3?u=dstepanic"
      date = "2021-03-11"
      score = 70
      id = "b0caf9d9-af0a-5181-85e4-6091cd6699e3"
   strings:
      $s1 = "ip.txt" ascii fullword
      $s2 = "arp.txt" ascii fullword
      $s3 = "system" ascii fullword 
      $s4 = "security" ascii fullword
   condition:
      uint32(0) == 0x4643534d and
      filesize < 10000KB and (
         $s1 in (0..200) and 
         $s2 in (0..200) and
         $s3 in (0..200) and
         $s4 in (0..200)
      )
}
YARA Detection Rule: WEBSHELL_Compiled_Webshell_Mar2021_1
Repository: Neo23x0/signature-base
Detects: Triggers on temporary pe files containing strings commonly used in webshells.
Author: Bundesamt fuer Sicherheit in der Informationstechnik
Reference: https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/Vorfaelle/Exchange-Schwachstellen-2021/MSExchange_Schwachstelle_Detektion_Reaktion.pdf

Pattern signatures:
$x1 = /App_Web_[a-zA-Z0-9]{7,8}.dll/ ascii wide fullword
      $a1 = "~/aspnet_client/" ascii wide nocase
      $a2 = "~/auth/" ascii wide nocase
      $b1 = "JScriptEvaluate" ascii wide fullword
      $c1 = "get_Request" ascii wide fullword
      $c2 = "get_Files" ascii wide fullword
      $c3 = "get_Count" ascii wide fullword
      $c4 = "get_Item" ascii wide fullword
      $c5 = "get_Server" ascii wide fullword

Detection condition:
uint16(0) == 0x5a4d and filesize > 5KB and filesize < 40KB and all of ($x*) and 1 of ($a*) and ( all of ($b*) or all of ($c*) )

Full rule:
rule WEBSHELL_Compiled_Webshell_Mar2021_1 {
   meta:
      description = "Triggers on temporary pe files containing strings commonly used in webshells."
      author = "Bundesamt fuer Sicherheit in der Informationstechnik"
      date = "2021-03-05"
      modified = "2021-03-12"
      reference = "https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/Vorfaelle/Exchange-Schwachstellen-2021/MSExchange_Schwachstelle_Detektion_Reaktion.pdf"
      id = "9336bd2c-791c-5c3e-9733-724a6a23864a"
   strings:
      $x1 = /App_Web_[a-zA-Z0-9]{7,8}.dll/ ascii wide fullword
      $a1 = "~/aspnet_client/" ascii wide nocase
      $a2 = "~/auth/" ascii wide nocase
      $b1 = "JScriptEvaluate" ascii wide fullword
      $c1 = "get_Request" ascii wide fullword
      $c2 = "get_Files" ascii wide fullword
      $c3 = "get_Count" ascii wide fullword
      $c4 = "get_Item" ascii wide fullword
      $c5 = "get_Server" ascii wide fullword
   condition:
      uint16(0) == 0x5a4d and filesize > 5KB and filesize < 40KB and all of ($x*) and 1 of ($a*) and ( all of ($b*) or all of ($c*) )
}
YARA Detection Rule: APT_MAL_ASP_DLL_HAFNIUM_Mar21_1
Repository: Neo23x0/signature-base
Detects: Detects HAFNIUM compiled ASP.NET DLLs dropped on compromised servers
Author: Florian Roth (Nextron Systems)
Reference: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

Pattern signatures:
$s1 = "Page_Load" ascii fullword
      
      $sc1 = { 20 00 3A 00 20 00 68 00 74 00 74 00 70 00 3A 00
               2F 00 2F 00 (66|67) 00 2F 00 00 89 A3 0D 00 0A 00 }

      $op1 = { 00 43 00 58 00 77 00 30 00 4a 00 45 00 00 51 7e 00 2f }
      $op2 = { 58 00 77 00 30 00 4a 00 45 00 00 51 7e 00 2f 00 61 00 }
      $op3 = { 01 0e 0e 05 20 01 01 11 79 04 07 01 12 2d 04 07 01 12 31 02 }
      $op4 = { 5e 00 03 00 bc 22 00 00 00 00 01 00 85 03 2b 00 03 00 cc }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 50KB and
      all of ($s*) or all of ($op*)

Full rule:
rule APT_MAL_ASP_DLL_HAFNIUM_Mar21_1 {
   meta:
      description = "Detects HAFNIUM compiled ASP.NET DLLs dropped on compromised servers"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
      date = "2021-03-05"
      score = 65
      hash1 = "097f5f700c000a13b91855beb61a931d34fb0abb738a110368f525e25c5bc738"
      hash2 = "15744e767cbaa9b37ff7bb5c036dda9b653fc54fc9a96fe73fbd639150b3daa3"
      hash3 = "52ae4de2e3f0ef7fe27c699cb60d41129a3acd4a62be60accc85d88c296e1ddb"
      hash4 = "5f0480035ee23a12302c88be10e54bf3adbcf271a4bb1106d4975a28234d3af8"
      hash5 = "6243fd2826c528ee[PII_REDACTED]55fd00153dee611ca33ec17effcf00205a6e4e"
      hash6 = "ebf6799bb86f0da2b05e66a0fe5a9b42df6dac848f4b951b2ed7b7a4866f19ef"
      id = "68b8252e-a07d-5507-b556-a4d473f98157"
   strings:
      $s1 = "Page_Load" ascii fullword
      
      $sc1 = { 20 00 3A 00 20 00 68 00 74 00 74 00 70 00 3A 00
               2F 00 2F 00 (66|67) 00 2F 00 00 89 A3 0D 00 0A 00 }

      $op1 = { 00 43 00 58 00 77 00 30 00 4a 00 45 00 00 51 7e 00 2f }
      $op2 = { 58 00 77 00 30 00 4a 00 45 00 00 51 7e 00 2f 00 61 00 }
      $op3 = { 01 0e 0e 05 20 01 01 11 79 04 07 01 12 2d 04 07 01 12 31 02 }
      $op4 = { 5e 00 03 00 bc 22 00 00 00 00 01 00 85 03 2b 00 03 00 cc }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 50KB and
      all of ($s*) or all of ($op*)
}
YARA Detection Rule: WEBSHELL_HAFNIUM_CISA_10328929_01
Repository: Neo23x0/signature-base
Detects: Detects CVE-2021-27065 Webshellz
Author: CISA Code & Media Analysis
Reference: https://us-cert.cisa.gov/ncas/analysis-reports/ar21-084a

Pattern signatures:
$s0 = { 65 76 61 6C 28 52 65 71 75 65 73 74 5B 22 [1-32] 5D 2C 22 75 6E 73 61 66 65 22 29 }
       $s1 = { 65 76 61 6C 28 }
       $s2 = { 28 52 65 71 75 65 73 74 2E 49 74 65 6D 5B [1-36] 5D 29 29 2C 22 75 6E 73 61 66 65 22 29 }
       $s3 = { 49 4F 2E 53 74 72 65 61 6D 57 72 69 74 65 72 28 52 65 71 75 65 73 74 2E 46 6F 72 6D 5B [1-24] 5D }
       $s4 = { 57 72 69 74 65 28 52 65 71 75 65 73 74 2E 46 6F 72 6D 5B [1-24] 5D }

Detection condition:
$s0 or ($s1 and $s2) or ($s3 and $s4)

Full rule:
rule WEBSHELL_HAFNIUM_CISA_10328929_01 : trojan webshell exploit CVE_2021_27065 {
   meta:
       author = "CISA Code & Media Analysis"
       date = "2021-03-17"
       description = "Detects CVE-2021-27065 Webshellz"
       hash = "c8a7b5ffcf23c7a334bb093dda19635ec06ca81f6196325bb2d811716c90f3c5"
       reference = "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-084a"
       id = "81916396-8aaa-5045-b31c-4bcce8d295a5"
   strings:
       $s0 = { 65 76 61 6C 28 52 65 71 75 65 73 74 5B 22 [1-32] 5D 2C 22 75 6E 73 61 66 65 22 29 }
       $s1 = { 65 76 61 6C 28 }
       $s2 = { 28 52 65 71 75 65 73 74 2E 49 74 65 6D 5B [1-36] 5D 29 29 2C 22 75 6E 73 61 66 65 22 29 }
       $s3 = { 49 4F 2E 53 74 72 65 61 6D 57 72 69 74 65 72 28 52 65 71 75 65 73 74 2E 46 6F 72 6D 5B [1-24] 5D }
       $s4 = { 57 72 69 74 65 28 52 65 71 75 65 73 74 2E 46 6F 72 6D 5B [1-24] 5D }
   condition:
       $s0 or ($s1 and $s2) or ($s3 and $s4)
}
YARA Detection Rule: WEBSHELL_HAFNIUM_CISA_10328929_02
Repository: Neo23x0/signature-base
Detects: Detects CVE-2021-27065 Exchange OAB VD MOD
Author: CISA Code & Media Analysis
Reference: https://us-cert.cisa.gov/ncas/analysis-reports/ar21-084a

Pattern signatures:
$s0 = { 4F 66 66 6C 69 6E 65 41 64 64 72 65 73 73 42 6F 6F 6B 73 }
       $s1 = { 3A 20 68 74 74 70 3A 2F 2F [1] 2F }
       $s2 = { 45 78 74 65 72 6E 61 6C 55 72 6C 20 20 20 20 }

Detection condition:
$s0 and $s1 and $s2

Full rule:
rule WEBSHELL_HAFNIUM_CISA_10328929_02 : trojan webshell exploit CVE_2021_27065 {
   meta:
       author = "CISA Code & Media Analysis"
       date = "2021-03-17"
       description = "Detects CVE-2021-27065 Exchange OAB VD MOD"
       hash = "c8a7b5ffcf23c7a334bb093dda19635ec06ca81f6196325bb2d811716c90f3c5"
       reference = "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-084a"
       id = "34a89a6e-fa8a-5c64-a325-30202e20b30f"
   strings:
       $s0 = { 4F 66 66 6C 69 6E 65 41 64 64 72 65 73 73 42 6F 6F 6B 73 }
       $s1 = { 3A 20 68 74 74 70 3A 2F 2F [1] 2F }
       $s2 = { 45 78 74 65 72 6E 61 6C 55 72 6C 20 20 20 20 }
   condition:
       $s0 and $s1 and $s2
}
YARA Detection Rule: WEBSHELL_ASPX_FileExplorer_Mar21_1
Repository: Neo23x0/signature-base
Detects: Detects Chopper like ASPX Webshells
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "<span style=\"background-color: #778899; color: #fff; padding: 5px; cursor: pointer\" onclick=" ascii
      $xc1 = { 3C 61 73 70 3A 48 69 64 64 65 6E 46 69 65 6C 64
               20 72 75 6E 61 74 3D 22 73 65 72 76 65 72 22 20
               49 44 3D 22 ?? ?? ?? ?? ?? 22 20 2F 3E 3C 62 72
               20 2F 3E 3C 62 72 20 2F 3E 20 50 72 6F 63 65 73
               73 20 4E 61 6D 65 3A 3C 61 73 70 3A 54 65 78 74
               42 6F 78 20 49 44 3D } 
      $xc2 = { 22 3E 43 6F 6D 6D 61 6E 64 3C 2F 6C 61 62 65 6C
               3E 3C 69 6E 70 75 74 20 69 64 3D 22 ?? ?? ?? ??
               ?? 22 20 74 79 70 65 3D 22 72 61 64 69 6F 22 20
               6E 61 6D 65 3D 22 74 61 62 73 22 3E 3C 6C 61 62
               65 6C 20 66 6F 72 3D 22 ?? ?? ?? ?? ?? 22 3E 46
               69 6C 65 20 45 78 70 6C 6F 72 65 72 3C 2F 6C 61
               62 65 6C 3E 3C 25 2D 2D }

      $r1 = "(Request.Form[" ascii
      $s1 = ".Text + \" Created!\";" ascii
      $s2 = "DriveInfo.GetDrives()" asc

Detection condition:
uint16(0) == 0x253c and
      filesize < 100KB and
      ( 1 of ($x*) or 2 of them ) or 4 of them

Full rule:
rule WEBSHELL_ASPX_FileExplorer_Mar21_1 {
   meta:
      description = "Detects Chopper like ASPX Webshells"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2021-03-31"
      score = 80
      hash1 = "a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75"
      id = "edcaa2a8-6fea-584e-90c2-307a2dfc9f7f"
   strings:
      $x1 = "<span style=\"background-color: #778899; color: #fff; padding: 5px; cursor: pointer\" onclick=" ascii
      $xc1 = { 3C 61 73 70 3A 48 69 64 64 65 6E 46 69 65 6C 64
               20 72 75 6E 61 74 3D 22 73 65 72 76 65 72 22 20
               49 44 3D 22 ?? ?? ?? ?? ?? 22 20 2F 3E 3C 62 72
               20 2F 3E 3C 62 72 20 2F 3E 20 50 72 6F 63 65 73
               73 20 4E 61 6D 65 3A 3C 61 73 70 3A 54 65 78 74
               42 6F 78 20 49 44 3D } 
      $xc2 = { 22 3E 43 6F 6D 6D 61 6E 64 3C 2F 6C 61 62 65 6C
               3E 3C 69 6E 70 75 74 20 69 64 3D 22 ?? ?? ?? ??
               ?? 22 20 74 79 70 65 3D 22 72 61 64 69 6F 22 20
               6E 61 6D 65 3D 22 74 61 62 73 22 3E 3C 6C 61 62
               65 6C 20 66 6F 72 3D 22 ?? ?? ?? ?? ?? 22 3E 46
               69 6C 65 20 45 78 70 6C 6F 72 65 72 3C 2F 6C 61
               62 65 6C 3E 3C 25 2D 2D }

      $r1 = "(Request.Form[" ascii
      $s1 = ".Text + \" Created!\";" ascii
      $s2 = "DriveInfo.GetDrives()" ascii
      $s3 = "Encoding.UTF8.GetString(FromBase64String(str.Replace(" ascii
      $s4 = "encodeURIComponent(btoa(String.fromCharCode.apply(null, new Uint8Array(bytes))));;"
   condition:
      uint16(0) == 0x253c and
      filesize < 100KB and
      ( 1 of ($x*) or 2 of them ) or 4 of them
}
YARA Detection Rule: WEBSHELL_ASPX_Chopper_Like_Mar21_1
Repository: Neo23x0/signature-base
Detects: Detects Chopper like ASPX Webshells
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "http://f/<script language=\"JScript\" runat=\"server\">var _0x" ascii
      $s2 = "));function Page_Load(){var _0x" ascii
      $s3 = ";eval(Request[_0x" ascii
      $s4 = "','orange','unsafe','" ascii

Detection condition:
filesize < 3KB and
      1 of them or 2 of them

Full rule:
rule WEBSHELL_ASPX_Chopper_Like_Mar21_1 {
   meta:
      description = "Detects Chopper like ASPX Webshells"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2021-03-31"
      score = 85
      hash1 = "ac44513e5ef93d8cbc[PII_REDACTED]c2246af6d5eb85c1b4302141d94c3b06c90"
      id = "a4dc1880-865f-5e20-89a2-3a642c453ef9"
   strings:
      $s1 = "http://f/<script language=\"JScript\" runat=\"server\">var _0x" ascii
      $s2 = "));function Page_Load(){var _0x" ascii
      $s3 = ";eval(Request[_0x" ascii
      $s4 = "','orange','unsafe','" ascii
   condition:
      filesize < 3KB and
      1 of them or 2 of them
}
YARA Detection Rule: crime_win32_dridex_socks5_mod
Repository: Neo23x0/signature-base
Detects: Detects Dridex socks5 module
Author: @VK_Intel
Reference: https://twitter.com/VK_Intel/status/[PII_REDACTED]23477760

Pattern signatures:
$s0 = "socks5_2_x32.dll"
        $s1 = "socks5_2_x64.dll"

Detection condition:
any of ($s*) and pe.exports("start")

Full rule:
rule crime_win32_dridex_socks5_mod {
    meta:
        description = "Detects Dridex socks5 module"
        author = "@VK_Intel"
        date = "2020-04-06"
        reference = "https://twitter.com/VK_Intel/status/[PII_REDACTED]23477760"
        id = "cee256b1-ad80-55dd-bbd3-0d3f7bc49664"
    strings:
        $s0 = "socks5_2_x32.dll"
        $s1 = "socks5_2_x64.dll"
    condition:
        any of ($s*) and pe.exports("start")
}
YARA Detection Rule: crime_win32_hvnc_banker_gen
Repository: Neo23x0/signature-base
Detects: Detects malware banker hidden VNC
Author: @VK_Intel
Reference: https://twitter.com/VK_Intel/status/[PII_REDACTED]23477760

Detection condition:
pe.exports("VncStartServer") and pe.exports("VncStopServer")

Full rule:
rule crime_win32_hvnc_banker_gen {
    meta:
        description = "Detects malware banker hidden VNC"
        author = "@VK_Intel"
        reference = "https://twitter.com/VK_Intel/status/[PII_REDACTED]23477760"
        date = "2020-04-06"
        id = "5e13f4a9-2231-524f-82b2-fbc6d6a43b6f"
    condition:
        pe.exports("VncStartServer") and pe.exports("VncStopServer")
}
YARA Detection Rule: SUSP_SVG_JS_Payload_Mar25
Repository: Neo23x0/signature-base
Detects: Detects a suspicious SVG file that contains a JavaScript payload. This rule is a generic rule that might generate false positives. A match should be further investigated.
Author: Florian Roth
Reference: Internal Research

Pattern signatures:
$a1 = "<svg xmlns=" ascii fullword

      $sx1 = "src=\"data:application/ecmascript;base64,"
      $sx2 = "=\"></script>"

      $ss1 = "<script type=\"application/ecmascript\">"
      $ss2 = "<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"100%\" height=\"100%\">"

Detection condition:
$a1 in (0..1024)
      and (
         filesize < 100KB and 1 of ($sx*)
         or 
         filesize < 1MB and 2 of ($s*)
      )

Full rule:
rule SUSP_SVG_JS_Payload_Mar25 {
   meta:
      description = "Detects a suspicious SVG file that contains a JavaScript payload. This rule is a generic rule that might generate false positives. A match should be further investigated."
      author = "Florian Roth"
      reference = "Internal Research"
      date = "2025-03-20"
      modified = "2025-03-21"
      score = 60
      hash = "7b4b8e42d4df56412969cd1c38dcb750d21b10a54d257a9b918bd6ae0e0f8d11"
      hash = "4ae2ebc103f5de7ccfd75603b543d602b5c793e1ef7db19fbb60ff2e42611f75"
      hash = "b92e9d6f8a516e78b3e848c4b5b2815b406c9478e6be3777f3e784ceedc66f4a"
      hash = "23ea832d503b02e9edbdbf9ed8ce0b19376d44580d21906d9da834de69f7dfcb"
      hash = "4f33dff59753773a596798ee58fb899c5382c6ec2951b457554aebe5c05ec0cd"
      hash = "b8be8e009b08c04857dc2388544d61db57c0dd1841371aa7e4bf3ee2010ef1a8"
      hash = "cdcbe23f284067c4e863f76370f8612d85bef0410ca0bb5684112a8c16eff21c"
      hash = "5b3d11109e0d10b9266cbfbb6906e728c4470d752f[PII_REDACTED]6d1166df4b43"
      hash = "a7620155da2a576823dbe7963ff4a5f79702645edb8b2ae67b8af8ba7eac697b"
      hash = "52e1c6279dc151616bbd85ac7d0abc42cab5850deb6da2e2b20e339f79c3536a"
      id = "cdb22283-8427-5c25-b653-d6d76dd27dc6"
   strings:
      $a1 = "<svg xmlns=" ascii fullword

      $sx1 = "src=\"data:application/ecmascript;base64,"
      $sx2 = "=\"></script>"

      $ss1 = "<script type=\"application/ecmascript\">"
      $ss2 = "<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"100%\" height=\"100%\">"
   condition:
      $a1 in (0..1024)
      and (
         filesize < 100KB and 1 of ($sx*)
         or 
         filesize < 1MB and 2 of ($s*)
      )
}