deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: cerber5
Repository: Yara-Rules/rules
Detects: Cerber5
Author: pekeinfo

Pattern signatures:
$a = {83 C4 04 A3 ?? ?? ?? 00 C7 45 ?? ?? ?? ?? 00 8B ?? ?? C6 0? 56 8B ?? ?? 5? 68 ?? ?? 4? 00 FF 15 ?? ?? 4? 00 50 FF 15 ?? ?? 4? 00 A3 ?? ?? 4? 00 68 1D 10 00 00 E8 ?? ?? FF FF 83 C4 04 ?? ?? ??}

Detection condition:
1 of them

Full rule:
rule cerber5{
meta:
  author = "pekeinfo"
  date = "2016-12-02"
  description = "Cerber5"
strings:
  $a = {83 C4 04 A3 ?? ?? ?? 00 C7 45 ?? ?? ?? ?? 00 8B ?? ?? C6 0? 56 8B ?? ?? 5? 68 ?? ?? 4? 00 FF 15 ?? ?? 4? 00 50 FF 15 ?? ?? 4? 00 A3 ?? ?? 4? 00 68 1D 10 00 00 E8 ?? ?? FF FF 83 C4 04 ?? ?? ??}
  
condition:
  1 of them 
}
YARA Detection Rule: cerber5b
Repository: Yara-Rules/rules
Detects: Cerber5b
Author: pekeinfo

Pattern signatures:
$a={8B ?? ?8 ?? 4? 00 83 E? 02 89 ?? ?8 ?? 4? 00 68 ?C ?9 4? 00 [0-6] ?? ?? ?? ?? ?? ?8 ?? 4? 00 5? FF 15 ?? ?9 4? 00 89 45 ?4 83 7D ?4 00 75 02 EB 12 8B ?? ?0 83 C? 06 89 ?? ?0 B? DD 03 00 00 85}

Detection condition:
$a

Full rule:
rule cerber5b{
meta:
  author = "pekeinfo"
  date = "2016-12-20"
  description = "Cerber5b"
strings:
  $a={8B ?? ?8 ?? 4? 00 83 E? 02 89 ?? ?8 ?? 4? 00 68 ?C ?9 4? 00 [0-6] ?? ?? ?? ?? ?? ?8 ?? 4? 00 5? FF 15 ?? ?9 4? 00 89 45 ?4 83 7D ?4 00 75 02 EB 12 8B ?? ?0 83 C? 06 89 ?? ?0 B? DD 03 00 00 85}  
condition:
  $a
}
YARA Detection Rule: Careto_SGH
Repository: Yara-Rules/rules
Detects: TheMask / Careto SGH component signature
Author: AlienVault (Alberto Ortega)
Reference: www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf

Pattern signatures:
$m1 = "PGPsdkDriver" ascii wide fullword
        $m2 = "jpeg1x32" ascii wide fullword
        $m3 = "SkypeIE6Plugin" ascii wide fullword
        $m4 = "CDllUninstall" ascii wide fullword

Detection condition:
2 of them

Full rule:
rule Careto_SGH 
{

    meta:
        author = "AlienVault (Alberto Ortega)"
        description = "TheMask / Careto SGH component signature"
        reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
        date = "2014/02/11"

    strings:
        $m1 = "PGPsdkDriver" ascii wide fullword
        $m2 = "jpeg1x32" ascii wide fullword
        $m3 = "SkypeIE6Plugin" ascii wide fullword
        $m4 = "CDllUninstall" ascii wide fullword

    condition:
        2 of them
}
YARA Detection Rule: Careto_OSX_SBD
Repository: Yara-Rules/rules
Detects: TheMask / Careto OSX component signature
Author: AlienVault (Alberto Ortega)
Reference: www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf

Pattern signatures:
/* XORed "/dev/null strdup() setuid(geteuid())" */
        $1 = {FF 16 64 0A 7E 1A 63 4D 21 4D 3E 1E 60 0F 7C 1A 65 0F 74 0B 3E 1C 7F 12}

Detection condition:
all of them

Full rule:
rule Careto_OSX_SBD 
{

    meta:
        author = "AlienVault (Alberto Ortega)"
        description = "TheMask / Careto OSX component signature"
        reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
        date = "2014/02/11"

    strings:
        /* XORed "/dev/null strdup() setuid(geteuid())" */
        $1 = {FF 16 64 0A 7E 1A 63 4D 21 4D 3E 1E 60 0F 7C 1A 65 0F 74 0B 3E 1C 7F 12}

    condition:
        all of them
}
YARA Detection Rule: Careto_CnC
Repository: Yara-Rules/rules
Detects: TheMask / Careto CnC communication signature
Author: AlienVault (Alberto Ortega)
Reference: www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf

Pattern signatures:
$1 = "cgi-bin/commcgi.cgi" ascii wide
        $2 = "Group" ascii wide
        $3 = "Install" ascii wide
        $4 = "Bn" ascii wide

Detection condition:
all of them

Full rule:
rule Careto_CnC 
{

    meta:
        author = "AlienVault (Alberto Ortega)"
        description = "TheMask / Careto CnC communication signature"
        reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
        date = "2014/02/11"

    strings:
        $1 = "cgi-bin/commcgi.cgi" ascii wide
        $2 = "Group" ascii wide
        $3 = "Install" ascii wide
        $4 = "Bn" ascii wide

    condition:
        all of them
}
YARA Detection Rule: Careto_CnC_domains
Repository: Yara-Rules/rules
Detects: TheMask / Careto known command and control domains
Author: AlienVault (Alberto Ortega)
Reference: www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf

Pattern signatures:
$1 = "linkconf.net" ascii wide nocase
        $2 = "redirserver.net" ascii wide nocase
        $3 = "swupdt.com" ascii wide nocase

Detection condition:
any of them

Full rule:
rule Careto_CnC_domains 
{

    meta:
        author = "AlienVault (Alberto Ortega)"
        description = "TheMask / Careto known command and control domains"
        reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
        date = "2014/02/11"

    strings:
        $1 = "linkconf.net" ascii wide nocase
        $2 = "redirserver.net" ascii wide nocase
        $3 = "swupdt.com" ascii wide nocase

    condition:
        any of them
}
YARA Detection Rule: BlackShades_3
Repository: Yara-Rules/rules
Detects: BlackShades RAT
Author: botherder https://github.com/botherder

Pattern signatures:
$mod1 = /(m)odAPI/
        $mod2 = /(m)odAudio/
        $mod3 = /(m)odBtKiller/
        $mod4 = /(m)odCrypt/
        $mod5 = /(m)odFuctions/
        $mod6 = /(m)odHijack/
        $mod7 = /(m)odICallBack/
        $mod8 = /(m)odIInet/
        $mod9 = /(m)odInfect/
        $mod10 = /(m)odInjPE/
        $mod11 = /(m)odLaunchWeb/
        $mod12 = /(m)odOS/
        $mod13 = /(m)odPWs/
        $mod14 = /(m)odRegistry/
        $mod15 = /(m)odScreencap/
        $mod16 = /(m)odSniff/
        $mod17 = /(m)odSocketMaster/
        $mod18 = /(m)odSpread/
        $mod19 = /(m)odSqueezer/
        $mod20 = /(m)odSS/
        $mod21 = /(m)odTorrentSeed/

        $tmr1 = /(t)mrAlarms/
        $tmr2 = /(t)mrAlive/
        $tmr3 = /(t)mrAnslut/
        $tmr4 = /(t)mrAudio/
        $tmr5 = /(t)mrBlink/
        $tmr6 = /(t)mrCheck/
        $tmr7 = /(t)mrCountdown/
        $tmr8 = /(t)mrCrazy/
        $tmr9 = /(t)mrDOS/
        $tmr10 = /(t)mrDoWork/
        $tmr11 = /(t)mrFocus/
        $tmr12 = /(t)mrGrabber

Detection condition:
10 of ($mod*) or 10 of ($tmr*)

Full rule:
rule BlackShades_3 : Trojan RAT
{
    meta:
        description = "BlackShades RAT"
	author = "botherder https://github.com/botherder"

    strings:
        $mod1 = /(m)odAPI/
        $mod2 = /(m)odAudio/
        $mod3 = /(m)odBtKiller/
        $mod4 = /(m)odCrypt/
        $mod5 = /(m)odFuctions/
        $mod6 = /(m)odHijack/
        $mod7 = /(m)odICallBack/
        $mod8 = /(m)odIInet/
        $mod9 = /(m)odInfect/
        $mod10 = /(m)odInjPE/
        $mod11 = /(m)odLaunchWeb/
        $mod12 = /(m)odOS/
        $mod13 = /(m)odPWs/
        $mod14 = /(m)odRegistry/
        $mod15 = /(m)odScreencap/
        $mod16 = /(m)odSniff/
        $mod17 = /(m)odSocketMaster/
        $mod18 = /(m)odSpread/
        $mod19 = /(m)odSqueezer/
        $mod20 = /(m)odSS/
        $mod21 = /(m)odTorrentSeed/

        $tmr1 = /(t)mrAlarms/
        $tmr2 = /(t)mrAlive/
        $tmr3 = /(t)mrAnslut/
        $tmr4 = /(t)mrAudio/
        $tmr5 = /(t)mrBlink/
        $tmr6 = /(t)mrCheck/
        $tmr7 = /(t)mrCountdown/
        $tmr8 = /(t)mrCrazy/
        $tmr9 = /(t)mrDOS/
        $tmr10 = /(t)mrDoWork/
        $tmr11 = /(t)mrFocus/
        $tmr12 = /(t)mrGrabber/
        $tmr13 = /(t)mrInaktivitet/
        $tmr14 = /(t)mrInfoTO/
        $tmr15 = /(t)mrIntervalUpdate/
        $tmr16 = /(t)mrLiveLogger/
        $tmr17 = /(t)mrPersistant/
        $tmr18 = /(t)mrScreenshot/
        $tmr19 = /(t)mrSpara/
        $tmr20 = /(t)mrSprid/
        $tmr21 = /(t)mrTCP/
        $tmr22 = /(t)mrUDP/
        $tmr23 = /(t)mrWebHide/

    condition:    
        10 of ($mod*) or 10 of ($tmr*)
}
YARA Detection Rule: BlackShades2
Repository: Yara-Rules/rules
Detects: BlackShades Server
Author: Kevin Falcoz

Pattern signatures:
$signature1={62 73 73 5F 73 65 72 76 65 72}
		$signature2={43 4C 49 43 4B 5F 44 45 4C 41 59 00 53 43 4B 5F 49 44}
		$signature3={6D 6F 64 49 6E 6A 50 45}

Detection condition:
$signature1 and $signature2 and $signature3

Full rule:
rule BlackShades2 : Trojan RAT
{
	meta:
		author="Kevin Falcoz"
		date="26/06/2013"
		description="BlackShades Server"
		
	strings:
		$signature1={62 73 73 5F 73 65 72 76 65 72}
		$signature2={43 4C 49 43 4B 5F 44 45 4C 41 59 00 53 43 4B 5F 49 44}
		$signature3={6D 6F 64 49 6E 6A 50 45}
		
	condition:
		$signature1 and $signature2 and $signature3
}
YARA Detection Rule: BlackShades_4
Repository: Yara-Rules/rules
Detects: BlackShades
Author: Jean-Philippe Teissier / @Jipe_

Pattern signatures:
$a = { 42 00 6C 00 61 00 63 00 6B 00 73 00 68 00 61 00 64 00 65 00 73 }
		$b = { 36 00 3C 00 32 00 20 00 32 00 32 00 26 00 31 00 39 00 3E 00 1D 00 17 00 17 00 1C 00 07 00 1B 00 03 00 07 00 28 00 23 00 0C 00 1D 00 10 00 1B 00 12 00 00 00 28 00 37 00 10 00 01 00 06 00 11 00 0B 00 07 00 22 00 11 00 17 00 00 00 1D 00 1B 00 0B 00 2F 00 26 00 01 00 0B }
		$c = { 62 73 73 5F 73 65 72 76 65 72 }
		$d = { 43 4C 49 43 4B 5F 44 45 4C 41 59 00 53 43 4B 5F 49 44 }
		$e = { 6D 6F 64 49 6E 6A 50 45 }
		$[CREDENTIAL_REDACTED]"

Detection condition:
any of ($a, $b, $c, $d, $e) or $apikey

Full rule:
rule BlackShades_4 : rat
{
	meta:
		description = "BlackShades"
		author = "Jean-Philippe Teissier / @Jipe_"
		date = "2013-01-12"
		filetype = "memory"
		version = "1.0" 

	strings:
		$a = { 42 00 6C 00 61 00 63 00 6B 00 73 00 68 00 61 00 64 00 65 00 73 }
		$b = { 36 00 3C 00 32 00 20 00 32 00 32 00 26 00 31 00 39 00 3E 00 1D 00 17 00 17 00 1C 00 07 00 1B 00 03 00 07 00 28 00 23 00 0C 00 1D 00 10 00 1B 00 12 00 00 00 28 00 37 00 10 00 01 00 06 00 11 00 0B 00 07 00 22 00 11 00 17 00 00 00 1D 00 1B 00 0B 00 2F 00 26 00 01 00 0B }
		$c = { 62 73 73 5F 73 65 72 76 65 72 }
		$d = { 43 4C 49 43 4B 5F 44 45 4C 41 59 00 53 43 4B 5F 49 44 }
		$e = { 6D 6F 64 49 6E 6A 50 45 }
		$[CREDENTIAL_REDACTED]"

	condition:
		any of ($a, $b, $c, $d, $e) or $apikey		
}
YARA Detection Rule: BlackShades
Repository: Yara-Rules/rules
Detects: BlackShades Server
Author: Kevin Falcoz

Pattern signatures:
$signature1={62 73 73 5F 73 65 72 76 65 72}
		$signature2={43 4C 49 43 4B 5F 44 45 4C 41 59 00 53 43 4B 5F 49 44}
		$signature3={6D 6F 64 49 6E 6A 50 45}

Detection condition:
$signature1 and $signature2 and $signature3

Full rule:
rule BlackShades : Trojan
{
	meta:
		author="Kevin Falcoz"
		date="26/06/2013"
		description="BlackShades Server"
		
	strings:
		$signature1={62 73 73 5F 73 65 72 76 65 72}
		$signature2={43 4C 49 43 4B 5F 44 45 4C 41 59 00 53 43 4B 5F 49 44}
		$signature3={6D 6F 64 49 6E 6A 50 45}
		
	condition:
		$signature1 and $signature2 and $signature3
}
YARA Detection Rule: BlackShades_25052015
Repository: Yara-Rules/rules
Malware family: blackshades
Author: Brian Wallace (@botnet_hunter)

Pattern signatures:
$string1 = "bss_server"
        $string2 = "txtChat"
        $string3 = "UDPFlood"

Detection condition:
all of them

Full rule:
rule BlackShades_25052015
{
    meta:
        author = "Brian Wallace (@botnet_hunter)"
        date = "2014/04"
        ref = "http://malwareconfig.com/stats/PoisonIvy"
        ref = "http://blog.cylance.com/a-study-in-bots-blackshades-net"
        family = "blackshades"

    strings:
        $string1 = "bss_server"
        $string2 = "txtChat"
        $string3 = "UDPFlood"
    condition:
        all of them
}
YARA Detection Rule: Spora
Repository: Yara-Rules/rules
Detects: Spora
Author: pekeinfo

Pattern signatures:
$a={7B 7F 4E 11 5D F3 FE 15 F9 55 FD 00 AD E9 CF FE E2 56 78 03 D0 21 46 00 30 68 C4 D0 01 FD 00 C3 B7 00 4A 0D 57 D2 52 91 05}
        $b={6F 51 3E 6B F9 15 29 D9 DF 26 1E 80 62 8A 0D E3 64 51 3B 0F F3 FE FF FF F3 FE FF FF F3 FE FF FF F3 FE FF FF}

Detection condition:
$a and $b

Full rule:
rule Spora
{
    meta:
        author = "pekeinfo"
        date = "2017-02-22"
        description = "Spora"
    
    strings:
        $a={7B 7F 4E 11 5D F3 FE 15 F9 55 FD 00 AD E9 CF FE E2 56 78 03 D0 21 46 00 30 68 C4 D0 01 FD 00 C3 B7 00 4A 0D 57 D2 52 91 05}
        $b={6F 51 3E 6B F9 15 29 D9 DF 26 1E 80 62 8A 0D E3 64 51 3B 0F F3 FE FF FF F3 FE FF FF F3 FE FF FF F3 FE FF FF}

    condition:
        $a and $b 
}
YARA Detection Rule: unk_packer
Repository: Yara-Rules/rules
Detects: Spora & Cerber ek
Author: pekeinfo

Pattern signatures:
$a = {0E 9E 52 69 C8 E4 73 BF 87 2B 95 15 33 1B B7 6B 46 62 D8 C1 01 A9 F9 17 FC EF 1A 6E B7 36 3C C4 72 7D 5D 1A 2D C4 7E 70 E8 0A A0 C6 A3 51 C1 1C 5E 98 E2 72 19 DF 03 C9 D4 25 25 1F EF 6B 46 75 9C BB 1D D2 57 56 35 75 31 35 56 8F B7 5B 23 3D }
        $b ={00 10 00 2E E8 77 EC FF FF 85 C0 0F 85 78 C4 FF}

Detection condition:
$a and $b

Full rule:
rule unk_packer
{
    meta:
        author = "pekeinfo"
        date = "2017-02-22"
        description = "Spora & Cerber ek"

    strings:
        $a = {0E 9E 52 69 C8 E4 73 BF 87 2B 95 15 33 1B B7 6B 46 62 D8 C1 01 A9 F9 17 FC EF 1A 6E B7 36 3C C4 72 7D 5D 1A 2D C4 7E 70 E8 0A A0 C6 A3 51 C1 1C 5E 98 E2 72 19 DF 03 C9 D4 25 25 1F EF 6B 46 75 9C BB 1D D2 57 56 35 75 31 35 56 8F B7 5B 23 3D }
        $b ={00 10 00 2E E8 77 EC FF FF 85 C0 0F 85 78 C4 FF}

    condition:
        $a and $b
}
YARA Detection Rule: ws_f0xy_downloader
Repository: Yara-Rules/rules
Detects: f0xy malware downloader
Author: Nick Griffin (Websense)

Pattern signatures:
$mz="MZ"
    $string1="bitsadmin /transfer"
    $string2="del rm.bat"
    $string3="av_list="

Detection condition:
($mz at 0) and (all of ($string*))

Full rule:
rule ws_f0xy_downloader {
  meta:
    description = "f0xy malware downloader"
    author = "Nick Griffin (Websense)"

  strings:
    $mz="MZ"
    $string1="bitsadmin /transfer"
    $string2="del rm.bat"
    $string3="av_list="
  
  condition:
    ($mz at 0) and (all of ($string*))
}
YARA Detection Rule: Cerberus
Repository: Yara-Rules/rules
Detects: Cerberus
Author: Jean-Philippe Teissier / @Jipe_

Pattern signatures:
$checkin = "Ypmw1Syv023QZD"
		$clientpong = "wZ2pla"
		$serverping = "wBmpf3Pb7RJe"
		$generic = "cerberus" nocase

Detection condition:
any of them

Full rule:
rule Cerberus : RAT memory
{
	meta:
		description = "Cerberus"
		author = "Jean-Philippe Teissier / @Jipe_"
		date = "2013-01-12"
		filetype = "memory"
		version = "1.0" 

	strings:
		$checkin = "Ypmw1Syv023QZD"
		$clientpong = "wZ2pla"
		$serverping = "wBmpf3Pb7RJe"
		$generic = "cerberus" nocase

	condition:
		any of them
}
YARA Detection Rule: ransom_comodosec_mrcr1
Repository: Yara-Rules/rules
Author:  J from THL <j@techhelplist.com>
Reference: https://virustotal.com/en/file/75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa/analysis/

Pattern signatures:
$text01 = "WebKitFormBoundary"
                $text02 = "Start NetworkScan"
                $text03 = "Start DriveScan"
                $text04 = "Start CryptFiles"
                $text05 = "cmd /c vssadmin delete shadows /all /quiet"
                $text06 = "isAutorun:"
                $text07 = "isNetworkScan:"
                $text08 = "isUserDataLast:"
                $text09 = "isCryptFileNames:"
                $text10 = "isChangeFileExts:"
                $text11 = "isPowerOffWindows:"
                $text12 = "GatePath:"
                $text13 = "GatePort:"
                $text14 = "DefaultCryptKey:"
                $text15 = "UserAgent:"
                $text16 = "Mozilla_"
                $text17 = "On Error Resume Next"
                $text18 = "Content-Disposition: form-data; name=\"uid\""
                $text19 = "Content-Disposition: form-data; name=\"uname\""
                $text20 = "Content-Disposition: form-data; name=\"cname\""
                $regx21 = /\|

Detection condition:
10 of them

Full rule:
rule ransom_comodosec_mrcr1 {

        meta:
                author = " J from THL <j@techhelplist.com>"
                date = "2017/01"
                reference = "https://virustotal.com/en/file/75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa/analysis/"
                version = 1
                maltype = "Ransomware"
                filetype = "memory"

        strings:
                $text01 = "WebKitFormBoundary"
                $text02 = "Start NetworkScan"
                $text03 = "Start DriveScan"
                $text04 = "Start CryptFiles"
                $text05 = "cmd /c vssadmin delete shadows /all /quiet"
                $text06 = "isAutorun:"
                $text07 = "isNetworkScan:"
                $text08 = "isUserDataLast:"
                $text09 = "isCryptFileNames:"
                $text10 = "isChangeFileExts:"
                $text11 = "isPowerOffWindows:"
                $text12 = "GatePath:"
                $text13 = "GatePort:"
                $text14 = "DefaultCryptKey:"
                $text15 = "UserAgent:"
                $text16 = "Mozilla_"
                $text17 = "On Error Resume Next"
                $text18 = "Content-Disposition: form-data; name=\"uid\""
                $text19 = "Content-Disposition: form-data; name=\"uname\""
                $text20 = "Content-Disposition: form-data; name=\"cname\""
                $regx21 = /\|[0-9a-z]{2,5}\|\|[0-9a-z]{2,5}\|\|[0-9a-z]{2,5}\|\|[0-9a-z]{2,5}\|/


    condition:
        10 of them
}
YARA Detection Rule: Arkei
Repository: Yara-Rules/rules
Detects: Arkei Stealer
Author: Fumik0_

Pattern signatures:
$s1 = "Arkei" wide ascii
        $s2 = "/server/gate" wide ascii
        $s3 = "/server/grubConfig" wide ascii
        $s4 = "\\files\\" wide ascii
        $s5 = "SQLite" wide ascii

Detection condition:
all of ($s*)

Full rule:
rule Arkei : Arkei 
{
    meta:
        Author = "Fumik0_" 
        Description = "Arkei Stealer"
        Date = "2018/07/10"
        Hash = "5632c89fe4c7c2c87b69d787bbf0a5b4cc535f1aa[PII_REDACTED]8c60e0ef88fc5"

    strings:
        $s1 = "Arkei" wide ascii
        $s2 = "/server/gate" wide ascii
        $s3 = "/server/grubConfig" wide ascii
        $s4 = "\\files\\" wide ascii
        $s5 = "SQLite" wide ascii

    condition:
        all of ($s*)	
}
YARA Detection Rule: leverage_a
Repository: Yara-Rules/rules
Detects: OSX/Leverage.A
Author: earada@alienvault.com

Pattern signatures:
$a1 = "ioreg -l | grep \"IOPlatformSerialNumber\" | awk -F"
		$a2 = "+:Users:Shared:UserEvent.app:Contents:MacOS:"
		$a3 = "rm '/Users/Shared/UserEvent.app/Contents/Resources/UserEvent.icns'"
		$script1 = "osascript -e 'tell application \"System Events\" to get the hidden of every login item'"
		$script2 = "osascript -e 'tell application \"System Events\" to get the name of every login item'"
		$script3 = "osascript -e 'tell application \"System Events\" to get the path of every login item'"
		$properties = "serverVisible \x00"

Detection condition:
all of them

Full rule:
rule leverage_a
{
	meta:
		author = "earada@alienvault.com"
		version = "1.0"
		description = "OSX/Leverage.A"
		date = "2013/09"
	strings:
		$a1 = "ioreg -l | grep \"IOPlatformSerialNumber\" | awk -F"
		$a2 = "+:Users:Shared:UserEvent.app:Contents:MacOS:"
		$a3 = "rm '/Users/Shared/UserEvent.app/Contents/Resources/UserEvent.icns'"
		$script1 = "osascript -e 'tell application \"System Events\" to get the hidden of every login item'"
		$script2 = "osascript -e 'tell application \"System Events\" to get the name of every login item'"
		$script3 = "osascript -e 'tell application \"System Events\" to get the path of every login item'"
		$properties = "serverVisible \x00"
	condition:
		all of them
}
YARA Detection Rule: unpacked_shiva_ransomware
Repository: Yara-Rules/rules
Detects: Rule to detect an unpacked sample of Shiva ransopmw
Author: Marc Rivero | @seifreed
Reference: https://twitter.com/malwrhunterteam/status/[PII_REDACTED]69732096

Pattern signatures:
$s1 = "c:\\Users\\sys\\Desktop\\v 0.5\\Shiva\\Shiva\\obj\\Debug\\shiva.pdb" fullword ascii
      $s2 = "This email will be as confirmation you are ready to pay for decryption key." fullword wide
      $s3 = "Your important files are now encrypted due to a security problem with your PC!" fullword wide
      $s4 = "write.php?info=" fullword wide
      $s5 = " * Do not try to decrypt your data using third party software, it may cause permanent data loss." fullword wide
      $s6 = " * Do not rename encrypted files." fullword wide
      $s7 = ".compositiontemplate" fullword wide
      $s8 = "You have to pay for decryption in Bitcoins. The price depends on how fast you write to us." fullword wide
      $s9 = "\\READ_IT.txt" fullword wide
      $s10 = ".lastlogin" fullword wide
      $s11 = ".logonxp" fullword wide
      $s12 = " * Decryption of your files with the help of third parties may cause increased price" fullword wide
      $s13 = "After payment we will send you the decryption tool 

Detection condition:
( uint16(0) == 0x5a4d and filesize < 800KB ) and all of them

Full rule:
rule unpacked_shiva_ransomware {

   meta:

      description = "Rule to detect an unpacked sample of Shiva ransopmw"
      author = "Marc Rivero | @seifreed"
      reference = "https://twitter.com/malwrhunterteam/status/[PII_REDACTED]69732096"
    
   strings:

      $s1 = "c:\\Users\\sys\\Desktop\\v 0.5\\Shiva\\Shiva\\obj\\Debug\\shiva.pdb" fullword ascii
      $s2 = "This email will be as confirmation you are ready to pay for decryption key." fullword wide
      $s3 = "Your important files are now encrypted due to a security problem with your PC!" fullword wide
      $s4 = "write.php?info=" fullword wide
      $s5 = " * Do not try to decrypt your data using third party software, it may cause permanent data loss." fullword wide
      $s6 = " * Do not rename encrypted files." fullword wide
      $s7 = ".compositiontemplate" fullword wide
      $s8 = "You have to pay for decryption in Bitcoins. The price depends on how fast you write to us." fullword wide
      $s9 = "\\READ_IT.txt" fullword wide
      $s10 = ".lastlogin" fullword wide
      $s11 = ".logonxp" fullword wide
      $s12 = " * Decryption of your files with the help of third parties may cause increased price" fullword wide
      $s13 = "After payment we will send you the decryption tool that will decrypt all your files." fullword wide
   
   condition:

      ( uint16(0) == 0x5a4d and filesize < 800KB ) and all of them 
}
YARA Detection Rule: termite_ransomware
Repository: Yara-Rules/rules
Detects: Rule to detect Termite Ransomware
Author: Marc Rivero | @seifreed
Reference: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/

Pattern signatures:
$s1 = "C:\\Windows\\SysNative\\mswsock.dll" fullword ascii
      $s2 = "C:\\Windows\\SysWOW64\\mswsock.dll" fullword ascii
      $s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Termite.exe" fullword ascii
      $s4 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Payment.exe" fullword ascii
      $s5 = "C:\\Windows\\Termite.exe" fullword ascii
      $s6 = "\\Shell\\Open\\Command\\" fullword ascii
      $s7 = "t314.520@qq.com" fullword ascii
      $s8 = "(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 6000KB ) and all of them

Full rule:
rule termite_ransomware {

   meta:

      description = "Rule to detect Termite Ransomware"
      author = "Marc Rivero | @seifreed"
      reference = "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/"
      
   strings:
      
      $s1 = "C:\\Windows\\SysNative\\mswsock.dll" fullword ascii
      $s2 = "C:\\Windows\\SysWOW64\\mswsock.dll" fullword ascii
      $s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Termite.exe" fullword ascii
      $s4 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Payment.exe" fullword ascii
      $s5 = "C:\\Windows\\Termite.exe" fullword ascii
      $s6 = "\\Shell\\Open\\Command\\" fullword ascii
      $s7 = "t314.520@qq.com" fullword ascii
      $s8 = "(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG" fullword ascii
      
   condition:
   
      ( uint16(0) == 0x5a4d and filesize < 6000KB ) and all of them 
}