deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EXPL_Shitrix_Exploit_Code_Jan20_1
Repository: Neo23x0/signature-base
Detects: Detects payloads used in Shitrix exploitation CVE-2019-19781
Author: Florian Roth (Nextron Systems)
Reference: https://isc.sans.edu/forums/diary/Citrix+ADC+Exploits+Overview+of+Observed+Payloads/25704/

Pattern signatures:
$s01 = "/netscaler/portal/scripts/rmpm.pl" ascii
      $s02 = "tee /netscaler/portal/templates/" ascii
      $s03 = "exec(\\'(wget -q -O- http://" ascii
      $s04 = "cd /netscaler/portal; ls" ascii
      $s05 = "cat /flash/nsconfig/ns.conf" ascii
      $s06 = "/netscaler/portal/scripts/PersonalBookmak.pl" ascii
      $s07 = "template.new({'BLOCK'='print readpipe(" ascii /* TrustedSec templae */
      $s08 = "pwnpzi1337" fullword ascii /* PZI india static user name */
      $s09 = "template.new({'BLOCK'=" /* PZI exploit URL decoded form */
      $s10 = "template.new({'BLOCK'%3d" /* PZI exploit URl encoded form */
      $s11 = "my ($citrixmd, %FORM);" /* Perl backdoor */
      $s12 = "(CMD, \"($citrixmd) 2>&1" /* Perl backdoor */

      $b1 = "NSC_USER:" ascii nocase /* https://twitter.com/ItsReallyNick/status/[PII_REDACTED]74496256 */
      $b2 = "NSC_NONCE:" ascii nocase /* https://twitter.com/ItsReallyNick/status/[PII_REDACTED]74496256 */
      $b3 = "/../" ascii

Detection condition:
1 of ($s*) or all of ($b*)

Full rule:
rule EXPL_Shitrix_Exploit_Code_Jan20_1 : FILE {
   meta:
      description = "Detects payloads used in Shitrix exploitation CVE-2019-19781"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://isc.sans.edu/forums/diary/Citrix+ADC+Exploits+Overview+of+Observed+Payloads/25704/"
      date = "2020-01-13"
      score = 70
      id = "7fab3a9b-82a5-573a-b210-2ae65f1a7f24"
   strings:
      $s01 = "/netscaler/portal/scripts/rmpm.pl" ascii
      $s02 = "tee /netscaler/portal/templates/" ascii
      $s03 = "exec(\\'(wget -q -O- http://" ascii
      $s04 = "cd /netscaler/portal; ls" ascii
      $s05 = "cat /flash/nsconfig/ns.conf" ascii
      $s06 = "/netscaler/portal/scripts/PersonalBookmak.pl" ascii
      $s07 = "template.new({'BLOCK'='print readpipe(" ascii /* TrustedSec templae */
      $s08 = "pwnpzi1337" fullword ascii /* PZI india static user name */
      $s09 = "template.new({'BLOCK'=" /* PZI exploit URL decoded form */
      $s10 = "template.new({'BLOCK'%3d" /* PZI exploit URl encoded form */
      $s11 = "my ($citrixmd, %FORM);" /* Perl backdoor */
      $s12 = "(CMD, \"($citrixmd) 2>&1" /* Perl backdoor */

      $b1 = "NSC_USER:" ascii nocase /* https://twitter.com/ItsReallyNick/status/[PII_REDACTED]74496256 */
      $b2 = "NSC_NONCE:" ascii nocase /* https://twitter.com/ItsReallyNick/status/[PII_REDACTED]74496256 */
      $b3 = "/../" ascii
   condition:
      1 of ($s*) or all of ($b*)
}
YARA Detection Rule: apt3_bemstour_implant_byte_patch
Repository: Neo23x0/signature-base
Detects: Detects an implant used by Bemstour exploitation tool (APT3)
Author: Mark Lechtik

Full rule:
rule apt3_bemstour_implant_byte_patch
{
meta:

description = "Detects an implant used by Bemstour exploitation tool (APT3)"
author = "Mark Lechtik"
company = "Check Point Software Technologies LTD."
date = "2019-06-25"
sha256 = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"

/*

0x41b7e1L C745B8558BEC83                mov dword ptr [ebp - 0x48], 0x83ec8b55
0x41b7e8L C745BCEC745356                mov dword ptr [ebp - 0x44], 0x565374ec
0x41b7efL C745C08B750833                mov dword ptr [ebp - 0x40], 0x3308758b
0x41b7f6L C745C4C957C745                mov dword ptr [ebp - 0x3c], 0x45c757c9
0x41b7fdL C745C88C4C6F61                mov dword ptr [ebp - 0x38], 0x616f4c8c

*/

uuid = "c30434c3-8949-566c-b6a6-29bffdaf961d"
strings:

$chunk_1 = {

C7 45 ?? 55 8B EC 83
C7 45 ?? EC 74 53 56
C7 45 ?? 8B 75 08 33
C7 45 ?? C9 57 C7 45
C7 45 ?? 8C 4C 6F 61

}
YARA Detection Rule: apt3_bemstour_implant_command_stack_variable
Repository: Neo23x0/signature-base
Detects: Detecs an implant used by Bemstour exploitation tool (APT3)
Author: Mark Lechtik

Full rule:
rule apt3_bemstour_implant_command_stack_variable
{
meta:

description = "Detecs an implant used by Bemstour exploitation tool (APT3)"
author = "Mark Lechtik"
company = "Check Point Software Technologies LTD."
date = "2019-06-25"
sha256 = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"


uuid = "c773da5a-2d3f-5a0a-af2e-28ad382622b3"
strings:


/*

0x41ba18L C78534FFFFFF636D642E          mov dword ptr [ebp - 0xcc], 0x2e646d63
0x41ba22L C78538FFFFFF65786520          mov dword ptr [ebp - 0xc8], 0x20657865
0x41ba2cL C7853CFFFFFF2F632063          mov dword ptr [ebp - 0xc4], 0x6320632f
0x41ba36L C78540FFFFFF6F707920          mov dword ptr [ebp - 0xc0], 0x2079706f
0x41ba40L C78544FFFFFF2577696E          mov dword ptr [ebp - 0xbc], 0x6e697725
0x41ba4aL C78548FFFFFF64697225          mov dword ptr [ebp - 0xb8], 0x25726964
0x41ba54L C7854CFFFFFF5C737973          mov dword ptr [ebp - 0xb4], 0x7379735c
0x41ba5eL C78550FFFFFF74656D33          mov dword ptr [ebp - 0xb0], 0x336d6574
0x41ba68L C78554FFFFFF325C636D          mov dword ptr [ebp - 0xac], 0x6d635c32
0x41ba72L C78558FFFFFF642E6578          mov dword ptr [ebp - 0xa8], 0x78652e64
0x41ba7cL C7855CFFFFFF65202577          mov dword ptr [ebp - 0xa4], 0x77252065
0x41ba86L C78560FFFFFF696E6469          mov dword ptr [ebp - 0xa0], 0x69646e69
0x41ba90L C78564FFFFFF72255C73          mov dword ptr [ebp - 0x9c], 0x735c2572
0x41ba9aL C78568FFFFFF79737465          mov dword ptr [ebp - 0x98], 0x65747379
0x41baa4L C7856CFFFFFF6D33325C          mov dword ptr [ebp - 0x94], 0x5c32336d
0x41baaeL C78570FFFFFF73657468          mov dword ptr [ebp - 0x90], 0x68746573
0x41bab8L C78574FFFFFF632E6578          mov dword ptr [ebp - 0x8c], 0x78652e63
0x41bac2L C78578FFFFFF65202F79          mov dword ptr [ebp - 0x88], 0x792f2065
0x41baccL 83A57CFFFFFF00                and dword ptr [ebp - 0x84], 0

*/

$chunk_1 = {

C7 85 ?? ?? ?? ?? 63 6D 64 2E
C7 85 ?? ?? ?? ?? 65 78 65 20
C7 85 ?? ?? ?? ?? 2F 63 20 63
C7 85 ?? ?? ?? ?? 6F 70 79 20
YARA Detection Rule: CoinMiner_Strings
Repository: Neo23x0/signature-base
Detects: Detects mining pool protocol string in Executable
Author: Florian Roth (Nextron Systems)
Reference: https://minergate.com/faq/what-pool-address

Pattern signatures:
$sa1 = "stratum+tcp://" ascii
      $sa2 = "stratum+udp://" ascii
      $sb1 = "\"normalHashing\": true,"

Detection condition:
filesize < 3000KB and 1 of them

Full rule:
rule CoinMiner_Strings : SCRIPT HIGHVOL {
   meta:
      description = "Detects mining pool protocol string in Executable"
      author = "Florian Roth (Nextron Systems)"
      score = 60
      reference = "https://minergate.com/faq/what-pool-address"
      date = "2018-01-04"
      modified = "2021-10-26"
      nodeepdive = 1
      id = "ac045f83-5f32-57a9-8011-99a2658a0e05"
   strings:
      $sa1 = "stratum+tcp://" ascii
      $sa2 = "stratum+udp://" ascii
      $sb1 = "\"normalHashing\": true,"
   condition:
      filesize < 3000KB and 1 of them
}
YARA Detection Rule: CoinHive_Javascript_MoneroMiner
Repository: Neo23x0/signature-base
Detects: Detects CoinHive - JavaScript Crypto Miner
Author: Florian Roth (Nextron Systems)
Reference: https://coinhive.com/documentation/miner

Pattern signatures:
$s2 = "CoinHive.CONFIG.REQUIRES_AUTH" fullword ascii

Detection condition:
filesize < 65KB and 1 of them

Full rule:
rule CoinHive_Javascript_MoneroMiner : HIGHVOL {
   meta:
      description = "Detects CoinHive - JavaScript Crypto Miner"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      score = 50
      reference = "https://coinhive.com/documentation/miner"
      date = "2018-01-04"
      id = "4f40c342-fcdc-5c73-a3cf-7b2ed438eaaf"
   strings:
      $s2 = "CoinHive.CONFIG.REQUIRES_AUTH" fullword ascii
   condition:
      filesize < 65KB and 1 of them
}
YARA Detection Rule: PUA_CryptoMiner_Jan19_1
Repository: Neo23x0/signature-base
Detects: Detects Crypto Miner strings
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "Stratum notify: invalid Merkle branch" fullword ascii
      $s2 = "-t, --threads=N       number of miner threads (default: number of processors)" fullword ascii
      $s3 = "User-Agent: cpuminer/" ascii
      $s4 = "hash > target (false positive)" fullword ascii
      $s5 = "thread %d: %lu hashes, %s khash/s" fullword ascii

Detection condition:
filesize < 1000KB and 1 of them

Full rule:
rule PUA_CryptoMiner_Jan19_1 {
   meta:
      description = "Detects Crypto Miner strings"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2019-01-31"
      score = 80
      hash1 = "ede858683267c61e710e367993f5e589fcb4b4b57b09d023a67ea63084c54a05"
      id = "aebfdce9-c2dd-5f24-aa25-071e1a961239"
   strings:
      $s1 = "Stratum notify: invalid Merkle branch" fullword ascii
      $s2 = "-t, --threads=N       number of miner threads (default: number of processors)" fullword ascii
      $s3 = "User-Agent: cpuminer/" ascii
      $s4 = "hash > target (false positive)" fullword ascii
      $s5 = "thread %d: %lu hashes, %s khash/s" fullword ascii
   condition:
      filesize < 1000KB and 1 of them
}
YARA Detection Rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21
Repository: Neo23x0/signature-base
Detects: Detects command line parameters often used by crypto mining software
Author: Florian Roth (Nextron Systems)
Reference: https://www.poolwatch.io/coin/monero

Pattern signatures:
$s01 = " --cpu-priority="
      $s02 = "--donate-level=0"
      $s03 = " -o pool."
      $s04 = " -o stratum+tcp://"
      $s05 = " --nicehash"
      $s06 = " --algo=rx/0 "

      /* base64 encoded: --donate-level= */
      $se1 = "LS1kb25hdGUtbGV2ZWw9"
      $se2 = "0tZG9uYXRlLWxldmVsP"
      $se3 = "tLWRvbmF0ZS1sZXZlbD"

      /* 
         base64 encoded:
         stratum+tcp:// 
         stratum+udp:// 
      */
      $se4 = "c3RyYXR1bSt0Y3A6Ly"
      $se5 = "N0cmF0dW0rdGNwOi8v"
      $se6 = "zdHJhdHVtK3RjcDovL"
      $se7 = "c3RyYXR1bSt1ZHA6Ly"
      $se8 = "N0cmF0dW0rdWRwOi8v"
      $se9 = "zdHJhdHVtK3VkcDovL"

Detection condition:
filesize < 5000KB and 1 of them

Full rule:
rule PUA_Crypto_Mining_CommandLine_Indicators_Oct21 : SCRIPT {
   meta:
      description = "Detects command line parameters often used by crypto mining software"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.poolwatch.io/coin/monero"
      date = "2021-10-24"
      score = 65
      id = "afe5a63a-08c3-5cb7-b4b1-b996068124b7"
   strings:
      $s01 = " --cpu-priority="
      $s02 = "--donate-level=0"
      $s03 = " -o pool."
      $s04 = " -o stratum+tcp://"
      $s05 = " --nicehash"
      $s06 = " --algo=rx/0 "

      /* base64 encoded: --donate-level= */
      $se1 = "LS1kb25hdGUtbGV2ZWw9"
      $se2 = "0tZG9uYXRlLWxldmVsP"
      $se3 = "tLWRvbmF0ZS1sZXZlbD"

      /* 
         base64 encoded:
         stratum+tcp:// 
         stratum+udp:// 
      */
      $se4 = "c3RyYXR1bSt0Y3A6Ly"
      $se5 = "N0cmF0dW0rdGNwOi8v"
      $se6 = "zdHJhdHVtK3RjcDovL"
      $se7 = "c3RyYXR1bSt1ZHA6Ly"
      $se8 = "N0cmF0dW0rdWRwOi8v"
      $se9 = "zdHJhdHVtK3VkcDovL"
   condition:
      filesize < 5000KB and 1 of them
}
YARA Detection Rule: rtf_cve2017_11882_ole
Repository: Neo23x0/signature-base
Detects: Attempts to identify the exploit CVE 2017 11882
Author: John Davison
Reference: https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about

Pattern signatures:
$headers = { 1c 00 00 00 02 00 ?? ?? a9 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 01 01 03 ?? }
        $font = { 0a 01 08 5a 5a } // <-- I think that 5a 5a is the trigger for the buffer overflow
        //$code = /[\x01-\x7F]{44}/
        $winexec = { 12 0c 43 00 }

Detection condition:
all of them and @font > @headers and @winexec == @font + 5 + 44

Full rule:
rule rtf_cve2017_11882_ole : malicious exploit cve_2017_11882 {
    meta:
        author = "John Davison"
        description = "Attempts to identify the exploit CVE 2017 11882"
        reference = "https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about"
        sample = "51cf2a6c0c1a29abca9fd13cb22421da"
        score = 60
        //file_name = "re:^stream_[0-9]+_[0-9]+.dat$"
        id = "b6c59cf1-52e4-5c9e-b3c3-d973d52736e3"
    strings:
        $headers = { 1c 00 00 00 02 00 ?? ?? a9 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 01 01 03 ?? }
        $font = { 0a 01 08 5a 5a } // <-- I think that 5a 5a is the trigger for the buffer overflow
        //$code = /[\x01-\x7F]{44}/
        $winexec = { 12 0c 43 00 }
    condition:
        all of them and @font > @headers and @winexec == @font + 5 + 44
}
YARA Detection Rule: rtf_cve2017_11882
Repository: Neo23x0/signature-base
Detects: Attempts to identify the exploit CVE 2017 11882
Author: John Davison
Reference: https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about

Pattern signatures:
$headers = { 31 63 30 30 30 30 30 30  30 32 30 30 ?? ?? ?? ??
                     61 39 30 30 30 30 30 30  ?? ?? ?? ?? ?? ?? ?? ??
                     ?? ?? ?? ?? ?? ?? ?? ??  ?? ?? ?? ?? ?? ?? ?? ??
                     ?? ?? ?? ?? ?? ?? ?? ??  30 33 30 31 30 31 30 33
                     ?? ?? }
        $font = { 30 61 30 31 30 38 35 61  35 61 }
        $winexec = { 31 32 30 63 34 33 30 30 }

Detection condition:
all of them and @font > @headers and @winexec == @font + ((5 + 44) * 2)

Full rule:
rule rtf_cve2017_11882 : malicious exploit cve_2017_1182 {
    meta:
        author = "John Davison"
        description = "Attempts to identify the exploit CVE 2017 11882"
        reference = "https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about"
        sample = "51cf2a6c0c1a29abca9fd13cb22421da"
        score = 60
        //file_ext = "rtf"
        id = "b6c59cf1-52e4-5c9e-b3c3-d973d52736e3"
    strings:
        $headers = { 31 63 30 30 30 30 30 30  30 32 30 30 ?? ?? ?? ??
                     61 39 30 30 30 30 30 30  ?? ?? ?? ?? ?? ?? ?? ??
                     ?? ?? ?? ?? ?? ?? ?? ??  ?? ?? ?? ?? ?? ?? ?? ??
                     ?? ?? ?? ?? ?? ?? ?? ??  30 33 30 31 30 31 30 33
                     ?? ?? }
        $font = { 30 61 30 31 30 38 35 61  35 61 }
        $winexec = { 31 32 30 63 34 33 30 30 }
    condition:
        all of them and @font > @headers and @winexec == @font + ((5 + 44) * 2)
}
YARA Detection Rule: packager_cve2017_11882
Repository: Neo23x0/signature-base
Detects: Attempts to exploit CVE-2017-11882 using Packager
Author: Rich Warren
Reference: https://github.com/rxwx/CVE-2017-11882/blob/master/packager_exec_CVE-2017-11882.py

Pattern signatures:
$font = { 30 61 30 31 30 38 35 61  35 61 }
      $equation = { 45 71 75 61 74 69 6F 6E 2E 33 }
      $package = { 50 61 63 6b 61 67 65 }
      $header_and_shellcode = /03010[0,1][0-9a-fA-F]{108}00/ ascii nocase

Detection condition:
uint32be(0) == 0x7B5C7274 // RTF header
      and all of them

Full rule:
rule packager_cve2017_11882 {
   meta:
      author = "Rich Warren"
      description = "Attempts to exploit CVE-2017-11882 using Packager"
      reference = "https://github.com/rxwx/CVE-2017-11882/blob/master/packager_exec_CVE-2017-11882.py"
      score = 60
      id = "57ff395e-e56a-5e63-bde6-f3cef038fcd6"
   strings:
      $font = { 30 61 30 31 30 38 35 61  35 61 }
      $equation = { 45 71 75 61 74 69 6F 6E 2E 33 }
      $package = { 50 61 63 6b 61 67 65 }
      $header_and_shellcode = /03010[0,1][0-9a-fA-F]{108}00/ ascii nocase
   condition:
      uint32be(0) == 0x7B5C7274 // RTF header
      and all of them
}
YARA Detection Rule: CVE_2017_11882_RTF
Repository: Neo23x0/signature-base
Detects: Detects suspicious Microsoft Equation OLE contents as used in CVE-2017-11882
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "4d534854412e[PII_REDACTED]747470" /* MSHTA.EXE http */
      $x2 = "6d736874612e[PII_REDACTED]747470" /* mshta.exe http */
      $x3 = "6d[PII_REDACTED]68747470" /* mshta http */
      $x4 = "4d[PII_REDACTED]68747470" /* MSHTA http */

      $s1 = "4d6963726f736f[PII_REDACTED]756174696f6e20332e30" ascii /* Microsoft Equation 3.0 */
      $s2 = "[PII_REDACTED][PII_REDACTED]69006f006e0020004e[PII_REDACTED][PII_REDACTED]" ascii /* Equation Native */
      $s3 = "2e[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0" /* .hta .... */

Detection condition:
( uint32be(0) == 0x7B5C7274 or uint32be(0) == 0x7B5C2A5C ) /* RTF */
      and filesize < 300KB and
      ( 1 of ($x*) or 2 of them )

Full rule:
rule CVE_2017_11882_RTF {
   meta:
      description = "Detects suspicious Microsoft Equation OLE contents as used in CVE-2017-11882"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2018-02-13"
      score = 60
      id = "400689ff-e856-5cbf-a7fa-93f6a8d8dbb9"
   strings:
      $x1 = "4d534854412e[PII_REDACTED]747470" /* MSHTA.EXE http */
      $x2 = "6d736874612e[PII_REDACTED]747470" /* mshta.exe http */
      $x3 = "6d[PII_REDACTED]68747470" /* mshta http */
      $x4 = "4d[PII_REDACTED]68747470" /* MSHTA http */

      $s1 = "4d6963726f736f[PII_REDACTED]756174696f6e20332e30" ascii /* Microsoft Equation 3.0 */
      $s2 = "[PII_REDACTED][PII_REDACTED]69006f006e0020004e[PII_REDACTED][PII_REDACTED]" ascii /* Equation Native */
      $s3 = "2e[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0" /* .hta .... */
   condition:
      ( uint32be(0) == 0x7B5C7274 or uint32be(0) == 0x7B5C2A5C ) /* RTF */
      and filesize < 300KB and
      ( 1 of ($x*) or 2 of them )
}
YARA Detection Rule: EXP_potential_CVE_2017_11882
Repository: Neo23x0/signature-base
Author: ReversingLabs
Reference: https://www.reversinglabs.com/newsroom/news/reversinglabs-yara-rule-detects-cobalt-strike-payload-exploiting-cve-2017-11882.html

Pattern signatures:
$docfilemagic = { D0 CF 11 E0 A1 B1 1A E1 }
        $equation1 = "Equation Native" wide ascii
        $equation2 = "Microsoft Equation 3.0" wide ascii
        $mshta = "mshta"
        $http  = "http://"
        $https = "https://"
        $cmd   = "cmd" fullword
        $pwsh  = "powershell"
        $exe   = ".exe"
        $address = { 12 0C 43 00 }

        $fp1 = "Tested with chamber evacuated to 1E-8 Torr on turbo pump" wide
        $fp2 = "d(3z2-r2) to d(x2-y2) is not experimentally identified yet in cuprates" wide
        $fp3 = "Preliminary results of MD simulation of Oxygen cluster infusion into Nb" wide
        $fp4 = "The Mixing is linked to the coefficients p and q" ascii

Detection condition:
uint16(0) == 0xcfd0 and $docfilemagic at 0 and
        any of ($mshta, $http, $https, $cmd, $pwsh, $exe) and any of ($equation1, $equation2) and $address
        and not 1 of ($fp*)

Full rule:
rule EXP_potential_CVE_2017_11882 {
    meta:
      author = "ReversingLabs"
      reference = "https://www.reversinglabs.com/newsroom/news/reversinglabs-yara-rule-detects-cobalt-strike-payload-exploiting-cve-2017-11882.html"
      id = "199710e0-5094-5940-ad29-f01383d5d8c2"
      modified = "2025-06-03"
    strings:
        $docfilemagic = { D0 CF 11 E0 A1 B1 1A E1 }
        $equation1 = "Equation Native" wide ascii
        $equation2 = "Microsoft Equation 3.0" wide ascii
        $mshta = "mshta"
        $http  = "http://"
        $https = "https://"
        $cmd   = "cmd" fullword
        $pwsh  = "powershell"
        $exe   = ".exe"
        $address = { 12 0C 43 00 }

        $fp1 = "Tested with chamber evacuated to 1E-8 Torr on turbo pump" wide
        $fp2 = "d(3z2-r2) to d(x2-y2) is not experimentally identified yet in cuprates" wide
        $fp3 = "Preliminary results of MD simulation of Oxygen cluster infusion into Nb" wide
        $fp4 = "The Mixing is linked to the coefficients p and q" ascii
    condition:
        uint16(0) == 0xcfd0 and $docfilemagic at 0 and
        any of ($mshta, $http, $https, $cmd, $pwsh, $exe) and any of ($equation1, $equation2) and $address
        and not 1 of ($fp*)
}
YARA Detection Rule: APT_MAL_CISA_10365227_03_ClientUploader_Dec21
Repository: Neo23x0/signature-base
Detects: Detects ClientUploader onedrv
Author: CISA Code & Media Analysis
Reference: https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a

Pattern signatures:
$s1 = "Decoder2"
       $s2 = "ClientUploader"
       $s3 = "AppDomain"
       $s4 = { 5F 49 73 52 65 70 47 ?? 44 65 63 6F 64 65 72 73 }
       $s5 = "LzmaDecoder"
       $s6 = "$ee1b3f3b-b13c-432e-a461-e52d273896a7"

Detection condition:
uint16(0) == 0x5a4d and all of them

Full rule:
rule APT_MAL_CISA_10365227_03_ClientUploader_Dec21 {
   meta:
       author = "CISA Code & Media Analysis"
       date = "2021-12-23"
       modified = "2021-12-24"
       score = 80
       description = "Detects ClientUploader onedrv"
       reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a"
       hash1 = "84164e1e8074c2565d3cd178babd93694ce54811641a77ffdc8d1084dd468afb"
       id = "4eeadb28-9312-5602-932a-36acb48772f4"
   strings:
       $s1 = "Decoder2"
       $s2 = "ClientUploader"
       $s3 = "AppDomain"
       $s4 = { 5F 49 73 52 65 70 47 ?? 44 65 63 6F 64 65 72 73 }
       $s5 = "LzmaDecoder"
       $s6 = "$ee1b3f3b-b13c-432e-a461-e52d273896a7"
   condition:
       uint16(0) == 0x5a4d and all of them
}
YARA Detection Rule: APT_MAL_CISA_10365227_01_APPSTORAGE_Dec21
Repository: Neo23x0/signature-base
Detects: Detects AppStorage ntstatus msexch samples
Malware family: APPSTORAGE
Author: CISA Code & Media Analysis
Reference: https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a

Pattern signatures:
$s1 = "026B924DD52F8BE4A3FEE8575DC"
       $s2 = "GetHDDId"
       $s3 = "AppStorage"
       $s4 = "AppDomain"
       $s5 = "$1e3e5580-d264-4c30-89c9-8933c948582c"
       $s6 = "hrjio2mfsdlf235d" wide

Detection condition:
uint16(0) == 0x5a4d and all of them

Full rule:
rule APT_MAL_CISA_10365227_01_APPSTORAGE_Dec21 {
   meta:
       author = "CISA Code & Media Analysis"
       date = "2021-12-23"
       modified = "2021-12-24"
       family = "APPSTORAGE"
       score = 80
       description = "Detects AppStorage ntstatus msexch samples"
       reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a"
       hash1 = "157a0ffd18e05bfd90a4ec108e5458cbde01015e3407b3964732c9d4ceb71656"
       hash2 = "30191b3badf3cdbc65d0ffeb68e0f26cef10a41037351b0f562ab52fce7432cc"
       id = "a44c5609-980f-5961-921c-6b1824cdd49c"
   strings:
       $s1 = "026B924DD52F8BE4A3FEE8575DC"
       $s2 = "GetHDDId"
       $s3 = "AppStorage"
       $s4 = "AppDomain"
       $s5 = "$1e3e5580-d264-4c30-89c9-8933c948582c"
       $s6 = "hrjio2mfsdlf235d" wide
   condition:
       uint16(0) == 0x5a4d and all of them
}