deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Unspecified_Malware_Oct16_D
Repository: Neo23x0/signature-base
Detects: Detects unspecified malware - October 2016
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "C:\\file.exe" fullword wide
      $s2 = "new.exe" fullword wide
      $s3 = "passwordIterations" fullword ascii

      $op0 = { 10 00 12 00 1a 00 05 00 01 00 01 00 01 00 10 00 } /* Opcode */
      $op1 = { 41 32 00 36 00 62 00 34 00 32 00 65 00 37 00 62 } /* Opcode */
      $op2 = { 3c 4d 6f 64 75 6c 65 3e 00 6e 65 77 2e 65 78 65 } /* Opcode */

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and ( all of ($s*) or all of ($op*) )

Full rule:
rule Unspecified_Malware_Oct16_D {
   meta:
      description = "Detects unspecified malware - October 2016"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2016-10-08"
      hash1 = "cd5f3bc0176a6803093ffdea6a7442c416e0d2945b6903063d17f5bb8d17519d"
      id = "6908467c-1ed6-508d-9503-246dd26823e5"
   strings:
      $s1 = "C:\\file.exe" fullword wide
      $s2 = "new.exe" fullword wide
      $s3 = "passwordIterations" fullword ascii

      $op0 = { 10 00 12 00 1a 00 05 00 01 00 01 00 01 00 10 00 } /* Opcode */
      $op1 = { 41 32 00 36 00 62 00 34 00 32 00 65 00 37 00 62 } /* Opcode */
      $op2 = { 3c 4d 6f 64 75 6c 65 3e 00 6e 65 77 2e 65 78 65 } /* Opcode */
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and ( all of ($s*) or all of ($op*) )
}
YARA Detection Rule: Unspecified_Malware_Oct16_E
Repository: Neo23x0/signature-base
Detects: Detects unspecified Malware - October 2016
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "P3pORt" fullword ascii
      $s2 = "msdownld.tmp" fullword ascii
      $s3 = "TMP4351$.TMP" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )

Full rule:
rule Unspecified_Malware_Oct16_E {
   meta:
      description = "Detects unspecified Malware - October 2016"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2016-10-08"
      hash1 = "[PII_REDACTED]0b61f22920c0ce6e56de1f2cd8eef589bebe2af31f36f51f2b4d01"
      id = "fffffe0c-e114-5648-96ea-dd692610e34c"
   strings:
      $s1 = "P3pORt" fullword ascii
      $s2 = "msdownld.tmp" fullword ascii
      $s3 = "TMP4351$.TMP" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )
}
YARA Detection Rule: APT28_CHOPSTICK
Repository: Neo23x0/signature-base
Detects: Detects a malware that behaves like CHOPSTICK mentioned in APT28 report
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/v3ebal

Pattern signatures:
$s0 = "jhuhugit.tmp" fullword ascii /* score: '14.005' */
		$s8 = "KERNEL32.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 14405 times */
		$s9 = "IsDebuggerPresent" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 3518 times */
		$s10 = "IsProcessorFeaturePresent" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 1383 times */
		$s11 = "TerminateProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 13081 times */
		$s13 = "DeleteFileA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 1384 times */
		$s15 = "GetProcessHeap" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 5875 times */
		$s16 = "!This program cannot be run in DOS mode." fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* 

Detection condition:
uint16(0) == 0x5a4d and filesize < 722KB and all of them

Full rule:
rule APT28_CHOPSTICK {
	meta:
		description = "Detects a malware that behaves like CHOPSTICK mentioned in APT28 report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/v3ebal"
		date = "2015-06-02"
		hash = "f4db2e0881f83f6a2387ecf446fcb4a4c9f99808"
		score = 60
		id = "08bc4cc2-1844-5218-bb89-20a3ac70a951"
	strings:
		$s0 = "jhuhugit.tmp" fullword ascii /* score: '14.005' */
		$s8 = "KERNEL32.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 14405 times */
		$s9 = "IsDebuggerPresent" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 3518 times */
		$s10 = "IsProcessorFeaturePresent" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 1383 times */
		$s11 = "TerminateProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 13081 times */
		$s13 = "DeleteFileA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 1384 times */
		$s15 = "GetProcessHeap" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 5875 times */
		$s16 = "!This program cannot be run in DOS mode." fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 20908 times */
		$s17 = "LoadLibraryA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 5461 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 722KB and all of them
}
YARA Detection Rule: APT28_SourFace_Malware1
Repository: Neo23x0/signature-base
Detects: Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server.
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html

Pattern signatures:
$s0 = "coreshell.dll" fullword wide /* PEStudio Blacklist: strings */
		$s1 = "Core Shell Runtime Service" fullword wide /* PEStudio Blacklist: strings */
		$s2 = "\\chkdbg.log" wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 62KB and all of them

Full rule:
rule APT28_SourFace_Malware1 {
	meta:
		description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
		date = "2015-06-01"
		hash1 = "e2450dffa675c61aa43077b25b12851a910eeeb6"
		hash2 = "d9c53adce8c35ec3b1e015ec[PII_REDACTED]e6800b"
		score = 60
		id = "d4275b8d-384f-58b7-bac5-05fb7db659e2"
	strings:
		$s0 = "coreshell.dll" fullword wide /* PEStudio Blacklist: strings */
		$s1 = "Core Shell Runtime Service" fullword wide /* PEStudio Blacklist: strings */
		$s2 = "\\chkdbg.log" wide
	condition:
		uint16(0) == 0x5a4d and filesize < 62KB and all of them
}
YARA Detection Rule: APT28_SourFace_Malware2
Repository: Neo23x0/signature-base
Detects: Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server.
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html

Pattern signatures:
$s0 = "coreshell.dll" fullword ascii /* PEStudio Blacklist: strings */
		$s1 = "Applicate" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 550KB and all of them

Full rule:
rule APT28_SourFace_Malware2 {
	meta:
		description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
		date = "2015-06-01"
		super_rule = 1
		hash0 = "367d40465fd1633c435b966fa9b289188aa444bc"
		hash1 = "cf3220c867b81949d1ce2b36446642de7894c6dc"
		hash2 = "ed48ef531d96e8c7360701da1c57e2ff13f12405"
		hash3 = "682e49efa6d2549147a21993d64291bfa40d815a"
		hash4 = "a8551397e1f1a2c0148e6eadcb56fa35ee6009ca"
		hash5 = "f5b3e98c6b5d65807da66d50bd5730d35692174d"
		score = 60
		id = "8a9df742-82c1-56bb-ab70-6384403f70b5"
	strings:
		$s0 = "coreshell.dll" fullword ascii /* PEStudio Blacklist: strings */
		$s1 = "Applicate" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 550KB and all of them
}
YARA Detection Rule: APT28_SourFace_Malware3
Repository: Neo23x0/signature-base
Detects: Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server.
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html

Pattern signatures:
$s0 = "coreshell.dll" fullword wide /* PEStudio Blacklist: strings */
		$s1 = "Core Shell Runtime Service" fullword wide /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 550KB and all of them

Full rule:
rule APT28_SourFace_Malware3 {
	meta:
		description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
		date = "2015-06-01"
		super_rule = 1
		hash0 = "[PII_REDACTED]8c82589fa290c0835805f3d9a2f8d6"
		hash1 = "d9c53adce8c35ec3b1e015ec[PII_REDACTED]e6800b"
		hash2 = "367d40465fd1633c435b966fa9b289188aa444bc"
		hash3 = "d87b310aa81ae6254fff27b7d57f76035f544073"
		hash4 = "cf3220c867b81949d1ce2b36446642de7894c6dc"
		hash5 = "ed48ef531d96e8c7360701da1c57e2ff13f12405"
		hash6 = "682e49efa6d2549147a21993d64291bfa40d815a"
		hash7 = "a8551397e1f1a2c0148e6eadcb56fa35ee6009ca"
		hash8 = "f5b3e98c6b5d65807da66d50bd5730d35692174d"
		hash9 = "e2450dffa675c61aa43077b25b12851a910eeeb6"
		score = 60
		id = "b49843b9-3a54-5525-958e-ac545cc00bde"
	strings:
		$s0 = "coreshell.dll" fullword wide /* PEStudio Blacklist: strings */
		$s1 = "Core Shell Runtime Service" fullword wide /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 550KB and all of them
}
YARA Detection Rule: APT28_SkinnyBoy_Dropper
Repository: Neo23x0/signature-base
Detects: Detects APT28 SkinnyBoy droppers
Author: Cluster25
Reference: https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf

Pattern signatures:
$ = "cmd /c DEL " ascii
      /* $ = " \"" ascii */ /* slowing down scanning */
      $ = {8a 08 40 84 c9 75 f9}
      $ = {0f b7 84 0d fc fe ff ff 66 31 84 0d fc fd ff ff}

Detection condition:
(uint16(0) == 0x5A4D and all of them)

Full rule:
rule APT28_SkinnyBoy_Dropper: RUSSIA {
   meta:
      description = "Detects APT28 SkinnyBoy droppers"
      author = "Cluster25"
      date = "2021-05-24"
      reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
      hash1 = "12331809c3e03d84498f428a37a28cf6cbb1dafe98c36463593ad12898c588c9"
      id = "ed0b2d2b-f820-57b5-9654-c24734d81996"
   strings:
      $ = "cmd /c DEL " ascii
      /* $ = " \"" ascii */ /* slowing down scanning */
      $ = {8a 08 40 84 c9 75 f9}
      $ = {0f b7 84 0d fc fe ff ff 66 31 84 0d fc fd ff ff}
   condition:
      (uint16(0) == 0x5A4D and all of them)
}
YARA Detection Rule: APT28_SkinnyBoy_Launcher
Repository: Neo23x0/signature-base
Detects: Detects APT28 SkinnyBoy launchers
Author: Cluster25
Reference: https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf

Pattern signatures:
$sha = {F4 EB 56 52 AF 4B 48 EE 08 FF 9D 44 89 4B D5 66 24 61 2A 15 1D 58 14 F9 6D 97
      13 2C 6D 07 6F 86}
      $l1 = "CryptGetHashParam" ascii
      $l2 = "CryptCreateHash" ascii
      $l3 = "FindNextFile" ascii
      $l4 = "PathAddBackslashW" ascii
      $l5 = "PathRemoveFileSpecW" ascii
      $h1 = {50 6A 00 6A 00 68 0C 80 00 00 FF ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A 00
      56 ?? ?? ?? ?? 50 FF ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ??}
      $h2 = {8B 01 3B 02 75 10 83 C1 04 83 C2 04 83 EE 04 73 EF}

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and ($sha or (all of ($l*) and all of ($h*)))

Full rule:
rule APT28_SkinnyBoy_Launcher: RUSSIA {
   meta:
      description = "Detects APT28 SkinnyBoy launchers"
      author = "Cluster25"
      date = "2021-05-24"
      reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
      hash1 ="2a652721243f29e82bdf57b565208c59937bbb6af4ab51e7b6ba7ed270ea6bce"
      id = "eaf4e8e5-cbec-5000-a2ff-31d1dac4c30f"
   strings:
      $sha = {F4 EB 56 52 AF 4B 48 EE 08 FF 9D 44 89 4B D5 66 24 61 2A 15 1D 58 14 F9 6D 97
      13 2C 6D 07 6F 86}
      $l1 = "CryptGetHashParam" ascii
      $l2 = "CryptCreateHash" ascii
      $l3 = "FindNextFile" ascii
      $l4 = "PathAddBackslashW" ascii
      $l5 = "PathRemoveFileSpecW" ascii
      $h1 = {50 6A 00 6A 00 68 0C 80 00 00 FF ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A 00
      56 ?? ?? ?? ?? 50 FF ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ??}
      $h2 = {8B 01 3B 02 75 10 83 C1 04 83 C2 04 83 EE 04 73 EF}
   condition:
      uint16(0) == 0x5a4d and filesize < 100KB and ($sha or (all of ($l*) and all of ($h*)))
}
YARA Detection Rule: APT28_SkinnyBoy_Implanter
Repository: Neo23x0/signature-base
Detects: Detects APT28 SkinnyBoy implanter
Author: Cluster25
Reference: https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf

Pattern signatures:
$enc_string = {F3 0F 7E 05 ?? ?? ?? ?? 6? [5] 6A ?? 66 [6] 66 [7] F3 0F 7E 05 ?? ?? ?? ?? 8D
      85 [4] 6A ?? 50 66 [7] E8}
      $heap_ops = {8B [1-5] 03 ?? 5? 5? 6A 08 FF [1-6] FF ?? ?? ?? ?? ?? [0-6] 8B ?? [0-6] 8?}
      $xor_cycle = { 8A 8C ?? ?? ?? ?? ?? 30 8C ?? ?? ?? ?? ?? 42 3B D0 72 }

Detection condition:
uint16(0) == 0x5a4d and pe.is_dll() and filesize < 100KB and $xor_cycle and $heap_ops and
      $enc_string

Full rule:
rule APT28_SkinnyBoy_Implanter: RUSSIA {
   meta:
      description = "Detects APT28 SkinnyBoy implanter"
      author = "Cluster25"
      date = "2021-05-24"
      reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
      hash1 = "ae0bc3358fef0ca2a103e694aa556f55a3fed4e98ba57d16f5ae7ad4ad583698"
      id = "c44faf95-a64c-58f4-97d4-2fe17aefc813"
   strings:
      $enc_string = {F3 0F 7E 05 ?? ?? ?? ?? 6? [5] 6A ?? 66 [6] 66 [7] F3 0F 7E 05 ?? ?? ?? ?? 8D
      85 [4] 6A ?? 50 66 [7] E8}
      $heap_ops = {8B [1-5] 03 ?? 5? 5? 6A 08 FF [1-6] FF ?? ?? ?? ?? ?? [0-6] 8B ?? [0-6] 8?}
      $xor_cycle = { 8A 8C ?? ?? ?? ?? ?? 30 8C ?? ?? ?? ?? ?? 42 3B D0 72 }
   condition:
      uint16(0) == 0x5a4d and pe.is_dll() and filesize < 100KB and $xor_cycle and $heap_ops and
      $enc_string
}
YARA Detection Rule: MAL_RANSOM_Venus_Nov22_1
Repository: Neo23x0/signature-base
Detects: Detects Venus Ransomware samples
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/dyngnosis/status/[PII_REDACTED]68421376

Pattern signatures:
$x1 = "<html><head><title>Venus</title><style type = \"text" ascii fullword
      $x2 = "xXBLTZKmAu9pjcfxrIK4gkDp/J9XXATjuysFRXG4rH4=" ascii fullword
      $x3 = "%s%x%x%x%x.goodgame" wide fullword

      $s1 = "/c ping localhost -n 3 > nul & del %s" ascii fullword
      $s2 = "C:\\Windows\\%s.png" wide

      $op1 = { 8b 4c 24 24 46 8b 7c 24 14 41 8b 44 24 30 81 c7 00 04 00 00 81 44 24 10 00 04 00 00 40 }
      $op2 = { 57 c7 45 fc 00 00 00 00 7e 3f 50 33 c0 74 03 9b 6e }
      $op3 = { 66 89 45 d4 0f 11 45 e8 e8 a8 e7 ff ff 83 c4 14 8d 45 e8 50 8d 45 a4 50 }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 700KB and
      (
         pe.imphash() == "bb2600e94092da119ee6acbbd047be43" or
         1 of ($x*) or
         2 of them
      ) 
      or 4 of them

Full rule:
rule MAL_RANSOM_Venus_Nov22_1 {
   meta:
      description = "Detects Venus Ransomware samples"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/dyngnosis/status/[PII_REDACTED]68421376"
      date = "2022-11-16"
      score = 85
      hash1 = "46f9cbc3795d6be0edd49a2c43efe6e610b82741755c5076a89eeccaf98ee834"
      hash2 = "6d8e2d8f6aeb0f4512a53fe83b2ef7699513ebaff31735675f46d1beea3a8e05"
      hash3 = "931cab7fbc0eb2bbc5768f8abdcc029cef76aff98540d9f5214786dccdb6a224"
      hash4 = "969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc"
      hash5 = "db6fcd33dcb3f25890c28e47c440845b17ce2042c34ade6d6508afd461bfa21c"
      hash6 = "ee036f333a0c4a24d9aa09848e635639e481695a[PII_REDACTED]eb71c9e453256b"
      hash7 = "fa7ba459236c7b27a0429f1961b992ab87fc8b3427469fd98bfc272ae6852063"
      id = "0f7e0ca4-c5e2-5557-92de-2e0d73035f12"
   strings:
      $x1 = "<html><head><title>Venus</title><style type = \"text" ascii fullword
      $x2 = "xXBLTZKmAu9pjcfxrIK4gkDp/J9XXATjuysFRXG4rH4=" ascii fullword
      $x3 = "%s%x%x%x%x.goodgame" wide fullword

      $s1 = "/c ping localhost -n 3 > nul & del %s" ascii fullword
      $s2 = "C:\\Windows\\%s.png" wide

      $op1 = { 8b 4c 24 24 46 8b 7c 24 14 41 8b 44 24 30 81 c7 00 04 00 00 81 44 24 10 00 04 00 00 40 }
      $op2 = { 57 c7 45 fc 00 00 00 00 7e 3f 50 33 c0 74 03 9b 6e }
      $op3 = { 66 89 45 d4 0f 11 45 e8 e8 a8 e7 ff ff 83 c4 14 8d 45 e8 50 8d 45 a4 50 }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 700KB and
      (
         pe.imphash() == "bb2600e94092da119ee6acbbd047be43" or
         1 of ($x*) or
         2 of them
      ) 
      or 4 of them
}
YARA Detection Rule: TempRacer
Repository: Neo23x0/signature-base
Detects: Detects privilege escalation tool - file TempRacer.exe
Author: Florian Roth (Nextron Systems)
Reference: http://www.darknet.org.uk/2016/03/tempracer-windows-privilege-escalation-tool/

Pattern signatures:
$s1 = "\\obj\\Release\\TempRacer.pdb" ascii
		$s2 = "[+] Injecting into " fullword wide
		$s3 = "net localgroup administrators alex /add" fullword wide
		$s4 = "[+] File: {0} renamed to {1}" fullword wide
		$s5 = "[+] Blocking " fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 25KB and 1 of them ) or ( 4 of them )

Full rule:
rule TempRacer {
	meta:
		description = "Detects privilege escalation tool - file TempRacer.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.darknet.org.uk/2016/03/tempracer-windows-privilege-escalation-tool/"
		date = "2016-03-30"
		hash = "e17d80c4822d16371d75e1440b6ac44af490b71fbee1010a3e8a5eca94d22bb3"
		id = "edba6471-9720-5aad-8c15-386197700c83"
	strings:
		$s1 = "\\obj\\Release\\TempRacer.pdb" ascii
		$s2 = "[+] Injecting into " fullword wide
		$s3 = "net localgroup administrators alex /add" fullword wide
		$s4 = "[+] File: {0} renamed to {1}" fullword wide
		$s5 = "[+] Blocking " fullword wide
	condition:
		( uint16(0) == 0x5a4d and filesize < 25KB and 1 of them ) or ( 4 of them )
}
YARA Detection Rule: MAL_DOC_ZLoader_Oct20_1
Repository: Neo23x0/signature-base
Detects: Detects weaponized ZLoader documents
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/JohnLaTwC/status/[PII_REDACTED]77452544

Pattern signatures:
$sc1 = { 78 4E FC 04 AB 6B 17 E2 33 E3 49 62 50 69 BB 60
               31 00 1E 00 02 4B BA E2 D8 E3 92 22 1E 69 96 20
               98 }
      $sc2 = { 6B 9E E2 36 E3 69 62 72 69 3A 60 55 6E }
      $sc3 = { 3E 69 76 60 59 6E 34 FB 87 6B 75 }

Detection condition:
uint16(0) == 0xcfd0 and
      filesize < 40KB and filesize > 30KB and
      all of them

Full rule:
rule MAL_DOC_ZLoader_Oct20_1 {
   meta:
      description = "Detects weaponized ZLoader documents"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/JohnLaTwC/status/[PII_REDACTED]77452544"
      date = "2020-10-10"
      hash1 = "668ca7ede54664360b0a44d5e19e76beb92c19659a8dec0e7085d05528df42b5"
      hash2 = "a2ffabbb1b5a124f462a51fee[PII_REDACTED]5ec084d768ffe1b1ef72d555eb0a0"
      hash3 = "d268af19db475893a3d19f76be30bb063ab2ca188d1b5a70e51d260105b201da"
      id = "34[PII_REDACTED]-5dd9-9dcf-99e3a3ceee4f"
   strings:
      $sc1 = { 78 4E FC 04 AB 6B 17 E2 33 E3 49 62 50 69 BB 60
               31 00 1E 00 02 4B BA E2 D8 E3 92 22 1E 69 96 20
               98 }
      $sc2 = { 6B 9E E2 36 E3 69 62 72 69 3A 60 55 6E }
      $sc3 = { 3E 69 76 60 59 6E 34 FB 87 6B 75 }
   condition:
      uint16(0) == 0xcfd0 and
      filesize < 40KB and filesize > 30KB and
      all of them
}
YARA Detection Rule: WEBSHELL_PAS_webshell
Repository: Neo23x0/signature-base
Detects: Detects P.A.S. PHP webshell - Based on DHS/FBI JAR-16-2029 (Grizzly  Steppe)
Author: FR/ANSSI/SDO (modified by Florian Roth)
Reference: https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf

Pattern signatures:
$php = "<?php"
      $strreplace = "(str_replace("
      $md5 = ".substr(md5(strrev($"
      $gzinflate = "gzinflate"
      $cookie = "_COOKIE"
      $isset = "isset"

Detection condition:
( filesize > 20KB and filesize < 200KB ) and
      all of them

Full rule:
rule WEBSHELL_PAS_webshell {
   meta:
      author = "FR/ANSSI/SDO (modified by Florian Roth)"
      description = "Detects P.A.S. PHP webshell - Based on DHS/FBI JAR-16-2029 (Grizzly  Steppe)"
      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
      date = "2021-02-15"
      score = 70
      id = "862aab77-936e-524c-8669-4f48730f4ed5"
   strings:
      $php = "<?php"
      $strreplace = "(str_replace("
      $md5 = ".substr(md5(strrev($"
      $gzinflate = "gzinflate"
      $cookie = "_COOKIE"
      $isset = "isset"
   condition:
      ( filesize > 20KB and filesize < 200KB ) and
      all of them
}
YARA Detection Rule: WEBSHELL_PAS_webshell_ZIPArchiveFile
Repository: Neo23x0/signature-base
Detects: Detects an archive file created by P.A.S. for download operation
Author: FR/ANSSI/SDO (modified by Florian Roth)
Reference: https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf

Pattern signatures:
$s1 = "Archive created by P.A.S. v."

Detection condition:
$s1

Full rule:
rule WEBSHELL_PAS_webshell_ZIPArchiveFile {
   meta:
      author = "FR/ANSSI/SDO (modified by Florian Roth)"
      description = "Detects an archive file created by P.A.S. for download operation"
      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
      date = "2021-02-15"
      score = 80
      id = "081cc65b-e51c-59fc-a518-cd986e8ee2f7"
   strings:
      $s1 = "Archive created by P.A.S. v."
   condition:
      $s1
}