deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Ysoserial_Payload_C3P0
Repository: Neo23x0/signature-base
Detects: Ysoserial Payloads - file C3P0.bin
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/frohoff/ysoserial

Pattern signatures:
$x1 = "exploitppppw" fullword ascii

Detection condition:
( uint16(0) == 0xedac and filesize < 3KB and all of them )

Full rule:
rule Ysoserial_Payload_C3P0 {
   meta:
      description = "Ysoserial Payloads - file C3P0.bin"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/frohoff/ysoserial"
      date = "2017-02-04"
      hash1 = "9932108d65e26d309bf7d97d389bc683e52e91eb68d0b1c8adfe318a4ec6e58b"
      id = "c269e032-b6ce-5faa-b3ce-a5304f3e9dab"
   strings:
      $x1 = "exploitppppw" fullword ascii
   condition:
      ( uint16(0) == 0xedac and filesize < 3KB and all of them )
}
YARA Detection Rule: Ysoserial_Payload_Spring1
Repository: Neo23x0/signature-base
Detects: Ysoserial Payloads - file Spring1.bin
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/frohoff/ysoserial

Pattern signatures:
$x1 = "ysoserial/Pwner" ascii

Detection condition:
1 of them

Full rule:
rule Ysoserial_Payload_Spring1 {
   meta:
      description = "Ysoserial Payloads - file Spring1.bin"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/frohoff/ysoserial"
      date = "2017-02-04"
      hash1 = "bf9b5f35bc1556d277853b71da24faf23cf9964d77245018a0fdf3359f3b1703"
      hash2 = "9c0be107d93096066e82a5404eb6829b1daa6aaa1a7b43bcda3ddac567ce715a"
      hash3 = "8cfa85c16d37fb2c38f277f39cafb6f0c0bd7ee62b14d53ad1dd9cb3f4b25dd8"
      hash4 = "5c44482350f1c6d68749c8dec167660ca6427999c37bfebaa54f677345cdf63c"
      hash5 = "95f966f2e8c5d0bcdfb34e603e3c0b911fa31fc960308e41fcd4459e4e07b4d1"
      hash6 = "1da04d838141c64711d87695a4cdb4eedfd4a206cc80922a41cfc82df8e24187"
      hash7 = "adf895fa95526c9ce48ec33297156dd69c3dbcdd2432000e61b2dd34ffc167c7"
      id = "c269e032-b6ce-5faa-b3ce-a5304f3e9dab"
   strings:
      $x1 = "ysoserial/Pwner" ascii
   condition:
      1 of them
}
YARA Detection Rule: Ysoserial_Payload
Repository: Neo23x0/signature-base
Detects: Ysoserial Payloads
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/frohoff/ysoserial

Pattern signatures:
$x1 = "ysoserial/payloads/" ascii

      $s1 = "StubTransletPayload" fullword ascii
      $s2 = "Pwnrpw" fullword ascii

Detection condition:
( uint16(0) == 0xedac and filesize < 40KB and $x1 ) or ( all of them )

Full rule:
rule Ysoserial_Payload {
   meta:
      description = "Ysoserial Payloads"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/frohoff/ysoserial"
      date = "2017-02-04"
      super_rule = 1
      hash1 = "9c0be107d93096066e82a5404eb6829b1daa6aaa1a7b43bcda3ddac567ce715a"
      hash2 = "adf895fa95526c9ce48ec33297156dd69c3dbcdd2432000e61b2dd34ffc167c7"
      hash3 = "1da04d838141c64711d87695a4cdb4eedfd4a206cc80922a41cfc82df8e24187"
      hash4 = "5c44482350f1c6d68749c8dec167660ca6427999c37bfebaa54f677345cdf63c"
      hash5 = "747ba6c6d88470e4d7c36107dfdff235f0ed492046c7ec8a8720d169f6d271f4"
      hash6 = "f0d2f1095da0164c03a0e801bd50f2f06793fb77938e53b14b57fd690d036929"
      hash7 = "5466d47363e11cd1852807b57d26a828728b9d5a[PII_REDACTED]b966bd0d8d7e56"
      hash8 = "95f966f2e8c5d0bcdfb34e603e3c0b911fa31fc960308e41fcd4459e4e07b4d1"
      hash9 = "1fea8b54bb92249203d68d5564a01599b42b46fc3a828fe0423616ee2a2f2d99"
      hash10 = "0143fee12fea5118be6dcbb862d8ba639790b7505eac00a9f1028481f874baa8"
      hash11 = "8cfa85c16d37fb2c38f277f39cafb6f0c0bd7ee62b14d53ad1dd9cb3f4b25dd8"
      hash12 = "bf9b5f35bc1556d277853b71da24faf23cf9964d77245018a0fdf3359f3b1703"
      hash13 = "f756c88763d48cb8d99e26b4773eb03814d0bd9bd467cc743ebb1479b2c4073e"
      id = "c269e032-b6ce-5faa-b3ce-a5304f3e9dab"
   strings:
      $x1 = "ysoserial/payloads/" ascii

      $s1 = "StubTransletPayload" fullword ascii
      $s2 = "Pwnrpw" fullword ascii
   condition:
      ( uint16(0) == 0xedac and filesize < 40KB and $x1 ) or ( all of them )
}
YARA Detection Rule: Ysoserial_Payload_3
Repository: Neo23x0/signature-base
Detects: Ysoserial Payloads - from files JavassistWeld1.bin, JBossInterceptors.bin
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/frohoff/ysoserial

Pattern signatures:
$x1 = "ysoserialq" fullword ascii

      $s1 = "targetClassInterceptorMetadatat" fullword ascii
      $s2 = "targetInstancet" fullword ascii
      $s3 = "targetClassL" fullword ascii
      $s4 = "POST_ACTIVATEsr" fullword ascii
      $s5 = "PRE_DESTROYsq" fullword ascii

Detection condition:
( uint16(0) == 0xedac and filesize < 10KB and $x1 ) or ( all of them )

Full rule:
rule Ysoserial_Payload_3 {
   meta:
      description = "Ysoserial Payloads - from files JavassistWeld1.bin, JBossInterceptors.bin"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/frohoff/ysoserial"
      date = "2017-02-04"
      super_rule = 1
      hash1 = "f0d2f1095da0164c03a0e801bd50f2f06793fb77938e53b14b57fd690d036929"
      hash2 = "5466d47363e11cd1852807b57d26a828728b9d5a[PII_REDACTED]b966bd0d8d7e56"
      id = "7fb67f48-66dc-57a4-9075-49b2277fa186"
   strings:
      $x1 = "ysoserialq" fullword ascii

      $s1 = "targetClassInterceptorMetadatat" fullword ascii
      $s2 = "targetInstancet" fullword ascii
      $s3 = "targetClassL" fullword ascii
      $s4 = "POST_ACTIVATEsr" fullword ascii
      $s5 = "PRE_DESTROYsq" fullword ascii
   condition:
      ( uint16(0) == 0xedac and filesize < 10KB and $x1 ) or ( all of them )
}
YARA Detection Rule: Malware_QA_not_copy
Repository: Neo23x0/signature-base
Detects: VT Research QA uploaded malware - file not copy.exe
Author: Florian Roth (Nextron Systems)
Reference: VT Research QA

Pattern signatures:
$x1 = "U2VydmVyLmV4ZQ==" fullword wide /* base64 encoded string 'Server.exe' */
		$x2 = "\\not copy\\obj\\Debug\\not copy.pdb" ascii
		$x3 = "fuckyou888.ddns.net" fullword wide

		$s1 = "cmd.exe /c ping 0 -n 2 & del \"" fullword wide
		$s2 = "Server.exe" fullword wide
		$s3 = "Execute ERROR" fullword wide
		$s4 = "not copy.exe" fullword wide
		$s5 = "Non HosT" fullword wide
		$s6 = "netsh firewall delete allowedprogram" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) or 4 of ($s*) ) )
		or ( 5 of them )

Full rule:
rule Malware_QA_not_copy {
	meta:
		description = "VT Research QA uploaded malware - file not copy.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "VT Research QA"
		date = "2016-08-29"
		score = 80
		hash1 = "1410f38498567b64a4b984c69fe4f2859421e4ac598b9750d8f703f1d209f836"
		id = "d618389b-ec80-5ad1-be44-4b1f3e36c07d"
	strings:
		$x1 = "U2VydmVyLmV4ZQ==" fullword wide /* base64 encoded string 'Server.exe' */
		$x2 = "\\not copy\\obj\\Debug\\not copy.pdb" ascii
		$x3 = "fuckyou888.ddns.net" fullword wide

		$s1 = "cmd.exe /c ping 0 -n 2 & del \"" fullword wide
		$s2 = "Server.exe" fullword wide
		$s3 = "Execute ERROR" fullword wide
		$s4 = "not copy.exe" fullword wide
		$s5 = "Non HosT" fullword wide
		$s6 = "netsh firewall delete allowedprogram" fullword wide
	condition:
		( uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) or 4 of ($s*) ) )
		or ( 5 of them )
}
YARA Detection Rule: Malware_QA_update
Repository: Neo23x0/signature-base
Detects: VT Research QA uploaded malware - file update.exe
Author: Florian Roth (Nextron Systems)
Reference: VT Research QA

Pattern signatures:
$x1 = "UnActiveOfflineKeylogger" fullword ascii
		$x2 = "BTRESULTDownload File|Mass Download : File Downloaded , Executing new one in temp dir...|" fullword ascii
		$x3 = "ActiveOnlineKeylogger" fullword ascii
		$x4 = "C:\\Users\\DarkCoderSc\\" ascii
		$x5 = "Celesty Binder\\Stub\\STATIC\\Stub.pdb" ascii
		$x6 = "BTRESULTUpdate from URL|Update : File Downloaded , Executing new one in temp dir...|" fullword ascii

		$s1 = "MSRSAAP.EXE" fullword wide
		$s2 = "Command successfully executed!|" fullword ascii
		$s3 = "BTMemoryLoadLibary: Get DLLEntyPoint failed" fullword ascii
		$s4 = "I wasn't able to open the hosts file, maybe because UAC is enabled in remote computer!" fullword ascii
		$s5 = "\\Internet Explorer\\iexplore.exe" ascii
		$s6 = "ping 127.0.0.1 -n 4 > NUL && \"" fullword ascii
		$s7 = "BTMemoryGetProcAddress: DLL doesn't export anything" fullword ascii
		$s8 = "POST /index.php/1.0" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 3000KB and ( 1 of ($x*) or 3 of ($s*) ) )
		or ( all of them )

Full rule:
rule Malware_QA_update {
	meta:
		description = "VT Research QA uploaded malware - file update.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "VT Research QA"
		date = "2016-08-29"
		score = 80
		hash1 = "6d805533623d[PII_REDACTED]eec38b7eb9b625533ccadeaf4f6c2cc6db32711541"
		hash2 = "6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e"
		id = "1dce684d-33b0-5588-8325-2a34c0cde32f"
	strings:
		$x1 = "UnActiveOfflineKeylogger" fullword ascii
		$x2 = "BTRESULTDownload File|Mass Download : File Downloaded , Executing new one in temp dir...|" fullword ascii
		$x3 = "ActiveOnlineKeylogger" fullword ascii
		$x4 = "C:\\Users\\DarkCoderSc\\" ascii
		$x5 = "Celesty Binder\\Stub\\STATIC\\Stub.pdb" ascii
		$x6 = "BTRESULTUpdate from URL|Update : File Downloaded , Executing new one in temp dir...|" fullword ascii

		$s1 = "MSRSAAP.EXE" fullword wide
		$s2 = "Command successfully executed!|" fullword ascii
		$s3 = "BTMemoryLoadLibary: Get DLLEntyPoint failed" fullword ascii
		$s4 = "I wasn't able to open the hosts file, maybe because UAC is enabled in remote computer!" fullword ascii
		$s5 = "\\Internet Explorer\\iexplore.exe" ascii
		$s6 = "ping 127.0.0.1 -n 4 > NUL && \"" fullword ascii
		$s7 = "BTMemoryGetProcAddress: DLL doesn't export anything" fullword ascii
		$s8 = "POST /index.php/1.0" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 3000KB and ( 1 of ($x*) or 3 of ($s*) ) )
		or ( all of them )
}
YARA Detection Rule: Malware_QA_tls
Repository: Neo23x0/signature-base
Detects: VT Research QA uploaded malware - file tls.exe
Author: Florian Roth (Nextron Systems)
Reference: VT Research QA

Pattern signatures:
$s1 = "\\funoverip\\ultimate-payload-template1\\" ascii
		$s2 = "ULTIMATEPAYLOADTEMPLATE1" fullword wide
		$s3 = "ultimate-payload-template1" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them ) or ( all of them )

Full rule:
rule Malware_QA_tls {
	meta:
		description = "VT Research QA uploaded malware - file tls.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "VT Research QA"
		date = "2016-08-29"
		score = 80
		hash1 = "f06d1f2bee2eb6590afbfa7f011ceba9bd91ba31cdc721bc728e13b547ac9370"
		id = "b3b654b1-73cf-5e04-a332-34777f646a66"
	strings:
		$s1 = "\\funoverip\\ultimate-payload-template1\\" ascii
		$s2 = "ULTIMATEPAYLOADTEMPLATE1" fullword wide
		$s3 = "ultimate-payload-template1" fullword wide
	condition:
		( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them ) or ( all of them )
}
YARA Detection Rule: Malware_QA_get_The_FucKinG_IP
Repository: Neo23x0/signature-base
Detects: VT Research QA uploaded malware - file get The FucKinG IP.exe
Author: Florian Roth (Nextron Systems)
Reference: VT Research QA

Pattern signatures:
$x1 = "C:\\Users\\Mdram ahmed\\AppData"
		$x2 = "\\Local\\Temporary Projects\\get The FucKinG IP\\" ascii
		$x3 = "get The FucKinG IP.exe" fullword wide
		$x4 = "get ip by mdr3m" fullword wide
		$x5 = "MDR3M kik: Mdr3mhm" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of ($x*) ) or ( 2 of them )

Full rule:
rule Malware_QA_get_The_FucKinG_IP {
	meta:
		description = "VT Research QA uploaded malware - file get The FucKinG IP.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "VT Research QA"
		date = "2016-08-29"
		score = 80
		hash1 = "7b2c04e384919075be96e3412d92c14fc1165d1bc7556fd207488959c5c4d2f7"
		id = "1c992fc5-79cf-532c-a18b-cfcc3406d6ed"
	strings:
		$x1 = "C:\\Users\\Mdram ahmed\\AppData"
		$x2 = "\\Local\\Temporary Projects\\get The FucKinG IP\\" ascii
		$x3 = "get The FucKinG IP.exe" fullword wide
		$x4 = "get ip by mdr3m" fullword wide
		$x5 = "MDR3M kik: Mdr3mhm" fullword wide
	condition:
		( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of ($x*) ) or ( 2 of them )
}
YARA Detection Rule: Malware_QA_vqgk
Repository: Neo23x0/signature-base
Detects: VT Research QA uploaded malware - file vqgk.dll
Author: Florian Roth (Nextron Systems)
Reference: VT Research QA

Pattern signatures:
$x1 = "Z:\\devcenter\\aggressor\\external" ascii
		$x2 = "\\beacon\\Release\\beacon.pdb" ascii
		$x3 = "%d is an x86 process (can't inject x64 content)" fullword ascii
		$x4 = "%d is an x64 process (can't inject x86 content)" fullword ascii

		$s1 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
		$s2 = "Could not open process token: %d (%u)" fullword ascii
		$s3 = "\\\\%s\\pipe\\msagent_%x" fullword ascii
		$s4 = "\\sysnative\\rundll32.exe" ascii
		$s5 = "Failed to impersonate logged on user %d (%u)" fullword ascii
		$s6 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
		$s7 = "could not write to process memory: %d" fullword ascii
		$s8 = "beacon.dll" fullword ascii
		$s9 = "Failed to impersonate token from %d (%u)" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 600KB and ( 1 of ($x*) or 5 of ($s*) ) ) or ( 7 of them )

Full rule:
rule Malware_QA_vqgk {
	meta:
		description = "VT Research QA uploaded malware - file vqgk.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "VT Research QA"
		date = "2016-08-29"
		modified = "2022-12-21"
		score = 80
		hash1 = "99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c"
		id = "9246d9de-92e5-5cb8-857c-1e222c3d74d5"
	strings:
		$x1 = "Z:\\devcenter\\aggressor\\external" ascii
		$x2 = "\\beacon\\Release\\beacon.pdb" ascii
		$x3 = "%d is an x86 process (can't inject x64 content)" fullword ascii
		$x4 = "%d is an x64 process (can't inject x86 content)" fullword ascii

		$s1 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
		$s2 = "Could not open process token: %d (%u)" fullword ascii
		$s3 = "\\\\%s\\pipe\\msagent_%x" fullword ascii
		$s4 = "\\sysnative\\rundll32.exe" ascii
		$s5 = "Failed to impersonate logged on user %d (%u)" fullword ascii
		$s6 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
		$s7 = "could not write to process memory: %d" fullword ascii
		$s8 = "beacon.dll" fullword ascii
		$s9 = "Failed to impersonate token from %d (%u)" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 600KB and ( 1 of ($x*) or 5 of ($s*) ) ) or ( 7 of them )
}
YARA Detection Rule: Malware_QA_1177
Repository: Neo23x0/signature-base
Detects: VT Research QA uploaded malware - file 1177.vbs
Author: Florian Roth (Nextron Systems)
Reference: VT Research QA

Pattern signatures:
$x1 = ".specialfolders (\"startup\") & \"\\ServerName.EXE\"" fullword ascii
		$x2 = "expandenvironmentstrings(\"%%InsallDir%%\") " ascii

		$s1 = "CreateObject(\"WScript.Shell\").Run(" ascii
		$s2 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAA" ascii
		$s3 = "cial Thank's to Dev-point.com" fullword ascii
		$s4 = ".createElement(\"tmp\")" fullword ascii
		$s5 = "'%CopyToStartUp%" fullword ascii

Detection condition:
( uint16(0) == 0x4d27 and filesize < 100KB and ( 1 of ($x*) or 4 of ($s*) ) )
		or ( 5 of them )

Full rule:
rule Malware_QA_1177 {
	meta:
		description = "VT Research QA uploaded malware - file 1177.vbs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "VT Research QA"
		date = "2016-08-29"
		score = 80
		hash1 = "ff3a2740330a6cbae7888e7066942b53015728c367cf9725e840af5b2a3fa247"
		id = "363228c1-f9f8-5319-91b2-7eabdd1ca3f8"
	strings:
		$x1 = ".specialfolders (\"startup\") & \"\\ServerName.EXE\"" fullword ascii
		$x2 = "expandenvironmentstrings(\"%%InsallDir%%\") " ascii

		$s1 = "CreateObject(\"WScript.Shell\").Run(" ascii
		$s2 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAA" ascii
		$s3 = "cial Thank's to Dev-point.com" fullword ascii
		$s4 = ".createElement(\"tmp\")" fullword ascii
		$s5 = "'%CopyToStartUp%" fullword ascii
	condition:
		( uint16(0) == 0x4d27 and filesize < 100KB and ( 1 of ($x*) or 4 of ($s*) ) )
		or ( 5 of them )
}
YARA Detection Rule: APT_Area1_SSF_PlugX
Repository: Neo23x0/signature-base
Detects: Detects send tool used in phishing campaign reported by Area 1 in December 2018
Author: Area 1
Reference: https://cdn.area1security.com/reports/Area-1-Security-PhishingDiplomacy.pdf

Pattern signatures:
$feature_call = { 8b 0? 56 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
         6a 07 6a ff ff d0 8b f0 85 f6 74 14 }
      $keylogger_reg = { 8b 4d 08 6a 0c 6a 01 8d 55 f4 52 c7 45 f4 01 00 06 00
         c7 45 f8 00 01 00 00 89 4d fc ff d0 85 c0 75 1d }
      $file_op = { 55 8b ec 83 ec 20 0f b7 56 18 8b 46 10 66 8b 4e 14 89 45 e4
         8d 44 32 10 66 89 4d f0 0f b7 4e 1a 57 89 45 e8 33 ff 8d 45 e0 8d 54
         31 10 50 89 7d e0 89 55 ec c7 45 fa ?? ?? ?? ?? 89 7d f2 89 7d f6 ff
         15 1c 43 02 10 }
      $ver_cmp = { 0f b6 8d b0 fe ff ff 0f b6 95 b4 fe ff ff 66 c1 e1 08 0f b7
         c1 0b c2 3d 02 05 00 00 7f 2c }
      $regedit = { c7 06 23 01 12 20 c7 46 04 01 90 00 00 89 5e 0c 89 5e 08 e8
         51 fb ff ff 8b 4d 08 8b 50 38 68 30 75 00 00 56 51 ff d2 }
      $get_device_caps = { 8b 1d ?? ?? ?? ?? 6a 08 50 ff d3 0f b7 56 12 8b c8 0f af ca
         b8 1f 85 eb 51 f7 e9 c1 fa 05 8b c2 c1 e8 1f 03 c2 89 45 f8 8b 45 f0 6a 0a 50 ff d3
         0f b7 56 14 8b c8 0f af ca

Detection condition:
3 of them

Full rule:
rule APT_Area1_SSF_PlugX {
   meta:
      description = "Detects send tool used in phishing campaign reported by Area 1 in December 2018"
      reference = "https://cdn.area1security.com/reports/Area-1-Security-PhishingDiplomacy.pdf"
      date = "2018-12-19"
      author = "Area 1"
      id = "a5b4e781-f0d1-55df-926c-2d321aa48139"
   strings:
      $feature_call = { 8b 0? 56 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
         6a 07 6a ff ff d0 8b f0 85 f6 74 14 }
      $keylogger_reg = { 8b 4d 08 6a 0c 6a 01 8d 55 f4 52 c7 45 f4 01 00 06 00
         c7 45 f8 00 01 00 00 89 4d fc ff d0 85 c0 75 1d }
      $file_op = { 55 8b ec 83 ec 20 0f b7 56 18 8b 46 10 66 8b 4e 14 89 45 e4
         8d 44 32 10 66 89 4d f0 0f b7 4e 1a 57 89 45 e8 33 ff 8d 45 e0 8d 54
         31 10 50 89 7d e0 89 55 ec c7 45 fa ?? ?? ?? ?? 89 7d f2 89 7d f6 ff
         15 1c 43 02 10 }
      $ver_cmp = { 0f b6 8d b0 fe ff ff 0f b6 95 b4 fe ff ff 66 c1 e1 08 0f b7
         c1 0b c2 3d 02 05 00 00 7f 2c }
      $regedit = { c7 06 23 01 12 20 c7 46 04 01 90 00 00 89 5e 0c 89 5e 08 e8
         51 fb ff ff 8b 4d 08 8b 50 38 68 30 75 00 00 56 51 ff d2 }
      $get_device_caps = { 8b 1d ?? ?? ?? ?? 6a 08 50 ff d3 0f b7 56 12 8b c8 0f af ca
         b8 1f 85 eb 51 f7 e9 c1 fa 05 8b c2 c1 e8 1f 03 c2 89 45 f8 8b 45 f0 6a 0a 50 ff d3
         0f b7 56 14 8b c8 0f af ca b8 1f 85 eb 51 }
   condition:
      3 of them
}
YARA Detection Rule: APT_Area1_SSF_GoogleSend_Strings
Repository: Neo23x0/signature-base
Detects: Detects send tool used in phishing campaign reported by Area 1 in December 2018
Author: Area 1 (modified by Florian Roth)
Reference: https://cdn.area1security.com/reports/Area-1-Security-PhishingDiplomacy.pdf

Pattern signatures:
$conf = "RefreshToken.ini" wide
      $client_id = "Enter your client ID here" wide
      $client_secret = "Enter your client secret here" wide
      $status = "We are going to send" wide
      $s1 = { b8 00 01 00 00 f0 0f b0 23 74 94 f3 90 80 3d ?? ?? ?? ?? 00 75 ??
         51 52 6a 00 e8 ?? ?? ?? ?? 5a 59 b8 00 01 00 00 f0 0f b0
         23 0f ?? ?? ?? ?? ?? 51 52 6a 0a e8 ?? ?? ?? ?? 5a 59 eb c3 }

Detection condition:
uint16(0) == 0x5a4d and 3 of them

Full rule:
rule APT_Area1_SSF_GoogleSend_Strings {
   meta:
      description = "Detects send tool used in phishing campaign reported by Area 1 in December 2018"
      reference = "https://cdn.area1security.com/reports/Area-1-Security-PhishingDiplomacy.pdf"
      date = "2018-12-19"
      author = "Area 1 (modified by Florian Roth)"
      id = "66a2faa1-b133-528c-91a9-06a43d2c00a0"
   strings:
      $conf = "RefreshToken.ini" wide
      $client_id = "Enter your client ID here" wide
      $client_secret = "Enter your client secret here" wide
      $status = "We are going to send" wide
      $s1 = { b8 00 01 00 00 f0 0f b0 23 74 94 f3 90 80 3d ?? ?? ?? ?? 00 75 ??
         51 52 6a 00 e8 ?? ?? ?? ?? 5a 59 b8 00 01 00 00 f0 0f b0
         23 0f ?? ?? ?? ?? ?? 51 52 6a 0a e8 ?? ?? ?? ?? 5a 59 eb c3 }
   condition:
      uint16(0) == 0x5a4d and 3 of them
}
YARA Detection Rule: MAL_Sharpshooter_Excel4
Repository: Neo23x0/signature-base
Detects: Detects Excel documents weaponized with Sharpshooter
Author: John Lambert, Florian Roth
Reference: https://github.com/mdsecactivebreach/SharpShooter

Pattern signatures:
$header_docf = { D0 CF 11 E0 }
      $s1 = "Excel 4.0 Macros"
      $f1 = "CreateThread" ascii fullword
      $f2 = "WriteProcessMemory" ascii fullword
      $f3 = "Kernel32" ascii fullword
      $concat = { 00 41 6f 00 08 1e ?? 00 41 6f 00 08 1e ?? 00 41 6f 00 08}

Detection condition:
filesize < 1000KB
      and $header_docf at 0
      and #concat > 10
      and $s1 and 2 of ($f*)

Full rule:
rule MAL_Sharpshooter_Excel4 {
   meta:
      description = "Detects Excel documents weaponized with Sharpshooter"
      author = "John Lambert, Florian Roth"
      reference = "https://github.com/mdsecactivebreach/SharpShooter"
      reference2="https://outflank.nl/blog/2018/10/06/old-school-evil-excel-4-0-macros-xlm/"
      reference3 = "https://gist.github.com/JohnLaTwC/efab89650d6fcbb37a4221e4c282614c"
      reference4 = "https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-xls/00b5dd7d-51ca-4938-b7b7-483fe0e5933b"
      date = "2020-03-27"
      score = 70
      hash="ccef64586d25ffcb2b28affc1f64319b936175c4911e7841a0e28ee6d6d4a02d"
      id = "a79e3afe-e8f9-5e56-a131-bb1b346df471"
   strings:
      $header_docf = { D0 CF 11 E0 }
      $s1 = "Excel 4.0 Macros"
      $f1 = "CreateThread" ascii fullword
      $f2 = "WriteProcessMemory" ascii fullword
      $f3 = "Kernel32" ascii fullword
      $concat = { 00 41 6f 00 08 1e ?? 00 41 6f 00 08 1e ?? 00 41 6f 00 08}
   condition:
      filesize < 1000KB
      and $header_docf at 0
      and #concat > 10
      and $s1 and 2 of ($f*)
}