deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: FSO_s_c99
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file c99.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s2 = "\"txt\",\"conf\",\"bat\",\"sh\",\"js\",\"bak\",\"doc\",\"log\",\"sfc\",\"cfg\",\"htacce"

Detection condition:
all of them

Full rule:
rule FSO_s_c99 {
	meta:
		description = "Webshells Auto-generated - file c99.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "5f9ba02eb081bba2b2434c603af454d0"
		id = "0b176370-a5ab-587a-b0e9-ef4fe5c604bd"
	strings:
		$s2 = "\"txt\",\"conf\",\"bat\",\"sh\",\"js\",\"bak\",\"doc\",\"log\",\"sfc\",\"cfg\",\"htacce"
	condition:
		all of them
}
YARA Detection Rule: rknt_zip_Folder_RkNT
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file RkNT.dll
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "PathStripPathA"
		$s1 = "`cLGet!Addr%"
		$s2 = "$Info: This file is packed with the UPX executable packer http://upx.tsx.org $"
		$s3 = "oQToOemBuff* <="
		$s4 = "ionCdunAsw[Us'"
		$s6 = "CreateProcessW: %S"
		$s7 = "ImageDirectoryEntryToData"

Detection condition:
all of them

Full rule:
rule rknt_zip_Folder_RkNT {
	meta:
		description = "Webshells Auto-generated - file RkNT.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "5f97386dfde148942b7584aeb6512b85"
		id = "a58a3b33-8096-535a-b930-2eb71347edb8"
	strings:
		$s0 = "PathStripPathA"
		$s1 = "`cLGet!Addr%"
		$s2 = "$Info: This file is packed with the UPX executable packer http://upx.tsx.org $"
		$s3 = "oQToOemBuff* <="
		$s4 = "ionCdunAsw[Us'"
		$s6 = "CreateProcessW: %S"
		$s7 = "ImageDirectoryEntryToData"
	condition:
		all of them
}
YARA Detection Rule: dbgntboot
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file dbgntboot.dll
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s2 = "now DOS is working at mode %d,faketype %d,against %s,has worked %d minutes,by sp"
		$s3 = "sth junk the M$ Wind0wZ retur"

Detection condition:
all of them

Full rule:
rule dbgntboot {
	meta:
		description = "Webshells Auto-generated - file dbgntboot.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "4d87543d4d7f73c1529c9f8066b475ab"
		id = "6b9381e6-597d-5e74-a318-9931d20a9d08"
	strings:
		$s2 = "now DOS is working at mode %d,faketype %d,against %s,has worked %d minutes,by sp"
		$s3 = "sth junk the M$ Wind0wZ retur"
	condition:
		all of them
}
YARA Detection Rule: PHP_shell
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file shell.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "AR8iROET6mMnrqTpC6W1Kp/DsTgxNby9H1xhiswfwgoAtED0y6wEXTihoAtICkIX6L1+vTUYWuWz"
		$s11 = "1HLp1qnlCyl5gko8rDlWHqf8/JoPKvGwEm9Q4nVKvEh0b0PKle3zeFiJNyjxOiVepMSpflJkPv5s"

Detection condition:
all of them

Full rule:
rule PHP_shell {
	meta:
		description = "Webshells Auto-generated - file shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "45e8a00567f8a34ab1cccc86b4bc74b9"
		id = "08dff4db-3b1c-5702-a8c9-efaedf83c4ff"
	strings:
		$s0 = "AR8iROET6mMnrqTpC6W1Kp/DsTgxNby9H1xhiswfwgoAtED0y6wEXTihoAtICkIX6L1+vTUYWuWz"
		$s11 = "1HLp1qnlCyl5gko8rDlWHqf8/JoPKvGwEm9Q4nVKvEh0b0PKle3zeFiJNyjxOiVepMSpflJkPv5s"
	condition:
		all of them
}
YARA Detection Rule: hxdef100
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file hxdef100.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "RtlAnsiStringToUnicodeString"
		$s8 = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\"
		$s9 = "\\\\.\\mailslot\\hxdef-rk100sABCDEFGH"

Detection condition:
all of them

Full rule:
rule hxdef100 {
	meta:
		description = "Webshells Auto-generated - file hxdef100.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "55cc1769cef44910bd91b7b73dee1f6c"
		id = "fb376c18-02d2-5866-a0e2-ccb5262091dd"
	strings:
		$s0 = "RtlAnsiStringToUnicodeString"
		$s8 = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\"
		$s9 = "\\\\.\\mailslot\\hxdef-rk100sABCDEFGH"
	condition:
		all of them
}
YARA Detection Rule: rdrbs100
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file rdrbs100.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s3 = "Server address must be IP in A.B.C.D format."
		$s4 = " mapped ports in the list. Currently "

Detection condition:
all of them

Full rule:
rule rdrbs100 {
	meta:
		description = "Webshells Auto-generated - file rdrbs100.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "7c752bcd6da796d80a6830c61a632bff"
		id = "369e5ce0-984c-54eb-96d4-fbfb4f932ba6"
	strings:
		$s3 = "Server address must be IP in A.B.C.D format."
		$s4 = " mapped ports in the list. Currently "
	condition:
		all of them
}
YARA Detection Rule: Mithril_Mithril
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file Mithril.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "OpenProcess error!"
		$s1 = "WriteProcessMemory error!"
		$s4 = "GetProcAddress error!"
		$s5 = "HHt`HHt\\"
		$s6 = "Cmaudi0"
		$s7 = "CreateRemoteThread error!"
		$s8 = "Kernel32"
		$s9 = "VirtualAllocEx error!"

Detection condition:
all of them

Full rule:
rule Mithril_Mithril {
	meta:
		description = "Webshells Auto-generated - file Mithril.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "017191562d72ab0ca551eb89256650bd"
		id = "81645f57-7d7e-5b4d-b323-744f2cde4916"
	strings:
		$s0 = "OpenProcess error!"
		$s1 = "WriteProcessMemory error!"
		$s4 = "GetProcAddress error!"
		$s5 = "HHt`HHt\\"
		$s6 = "Cmaudi0"
		$s7 = "CreateRemoteThread error!"
		$s8 = "Kernel32"
		$s9 = "VirtualAllocEx error!"
	condition:
		all of them
}
YARA Detection Rule: hxdef100_2
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file hxdef100.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "\\\\.\\mailslot\\hxdef-rkc000"
		$s2 = "Shared Components\\On Access Scanner\\BehaviourBlo"
		$s6 = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\"

Detection condition:
all of them

Full rule:
rule hxdef100_2 {
	meta:
		description = "Webshells Auto-generated - file hxdef100.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "1b393e2e13b9c57fb501b7cd7ad96b25"
		id = "1f079b73-29de-50cf-868c-1639a43e576f"
	strings:
		$s0 = "\\\\.\\mailslot\\hxdef-rkc000"
		$s2 = "Shared Components\\On Access Scanner\\BehaviourBlo"
		$s6 = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\"
	condition:
		all of them
}
YARA Detection Rule: Release_dllTest
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file dllTest.dll
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = ";;;Y;`;d;h;l;p;t;x;|;"
		$s1 = "0 0&00060K0R0X0f0l0q0w0"
		$s2 = ": :$:(:,:0:4:8:D:`=d="
		$s3 = "4@5P5T5\\5T7\\7d7l7t7|7"
		$s4 = "1,121>1C1K1Q1X1^1e1k1s1y1"
		$s5 = "9 9$9(9,9P9X9\\9`9d9h9l9p9t9x9|9"
		$s6 = "0)0O0\\0a0o0\"1E1P1q1"
		$s7 = "<.<I<d<h<l<p<t<x<|<"
		$s8 = "3&31383>3F3Q3X3`3f3w3|3"
		$s9 = "8@;D;H;L;P;T;X;\\;a;9=W=z="

Detection condition:
all of them

Full rule:
rule Release_dllTest {
	meta:
		description = "Webshells Auto-generated - file dllTest.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "76a59fc3242a2819307bb9d593bef2e0"
		id = "af[PII_REDACTED]-5572-9014-59e8c5feaacd"
	strings:
		$s0 = ";;;Y;`;d;h;l;p;t;x;|;"
		$s1 = "0 0&00060K0R0X0f0l0q0w0"
		$s2 = ": :$:(:,:0:4:8:D:`=d="
		$s3 = "4@5P5T5\\5T7\\7d7l7t7|7"
		$s4 = "1,121>1C1K1Q1X1^1e1k1s1y1"
		$s5 = "9 9$9(9,9P9X9\\9`9d9h9l9p9t9x9|9"
		$s6 = "0)0O0\\0a0o0\"1E1P1q1"
		$s7 = "<.<I<d<h<l<p<t<x<|<"
		$s8 = "3&31383>3F3Q3X3`3f3w3|3"
		$s9 = "8@;D;H;L;P;T;X;\\;a;9=W=z="
	condition:
		all of them
}
YARA Detection Rule: webadmin
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file webadmin.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "<input name=\\\"editfilename\\\" type=\\\"text\\\" class=\\\"style1\\\" value='\".$this->inpu"

Detection condition:
all of them

Full rule:
rule webadmin {
	meta:
		description = "Webshells Auto-generated - file webadmin.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "3a90de401b30e5b590362ba2dde30937"
		id = "615d87f8-9094-5994-aea1-d7276623fbca"
	strings:
		$s0 = "<input name=\\\"editfilename\\\" type=\\\"text\\\" class=\\\"style1\\\" value='\".$this->inpu"
	condition:
		all of them
}
YARA Detection Rule: commands
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file commands.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "If CheckRecord(\"SELECT COUNT(ID) FROM VictimDetail WHERE VictimID = \" & VictimID"
		$s2 = "proxyArr = Array (\"HTTP_X_FORWARDED_FOR\",\"HTTP_VIA\",\"HTTP_CACHE_CONTROL\",\"HTTP_F"

Detection condition:
all of them

Full rule:
rule commands {
	meta:
		description = "Webshells Auto-generated - file commands.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "174486fe844cb388e2ae3494ac2d1ec2"
		id = "7cffefc7-4f24-5908-82a4-f11eda398377"
	strings:
		$s1 = "If CheckRecord(\"SELECT COUNT(ID) FROM VictimDetail WHERE VictimID = \" & VictimID"
		$s2 = "proxyArr = Array (\"HTTP_X_FORWARDED_FOR\",\"HTTP_VIA\",\"HTTP_CACHE_CONTROL\",\"HTTP_F"
	condition:
		all of them
}
YARA Detection Rule: hkdoordll
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file hkdoordll.dll
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s6 = "Can't uninstall,maybe the backdoor is not installed or,the Password you INPUT is"

Detection condition:
all of them

Full rule:
rule hkdoordll {
	meta:
		description = "Webshells Auto-generated - file hkdoordll.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "b715c009d47686c0e62d0981efce2552"
		id = "c4cfb575-89c3-5a72-8bf5-234d4284fe9d"
	strings:
		$s6 = "Can't uninstall,maybe the backdoor is not installed or,the Password you INPUT is"
	condition:
		all of them
}
YARA Detection Rule: r57shell_2
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file r57shell.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s2 = "echo \"<br>\".ws(2).\"HDD Free : <b>\".view_size($free).\"</b> HDD Total : <b>\".view_"

Detection condition:
all of them

Full rule:
rule r57shell_2 {
	meta:
		description = "Webshells Auto-generated - file r57shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "[PII_REDACTED]cddf8aee5dec6072ed02b5"
		id = "d3a3fe11-c9e1-523b-88a3-ddc0c1085d04"
	strings:
		$s2 = "echo \"<br>\".ws(2).\"HDD Free : <b>\".view_size($free).\"</b> HDD Total : <b>\".view_"
	condition:
		all of them
}
YARA Detection Rule: Mithril_v1_45_dllTest
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file dllTest.dll
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s3 = "syspath"
		$s4 = "\\Mithril"
		$s5 = "--list the services in the computer"

Detection condition:
all of them

Full rule:
rule Mithril_v1_45_dllTest {
	meta:
		description = "Webshells Auto-generated - file dllTest.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "1b9e518aaa62b15079ff6edb412b21e9"
		id = "2aea84b6-1b51-58cd-b52b-c31b1f75d295"
	strings:
		$s3 = "syspath"
		$s4 = "\\Mithril"
		$s5 = "--list the services in the computer"
	condition:
		all of them
}
YARA Detection Rule: dbgiis6cli
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file dbgiis6cli.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
		$s5 = "###command:(NO more than 100 bytes!)"

Detection condition:
all of them

Full rule:
rule dbgiis6cli {
	meta:
		description = "Webshells Auto-generated - file dbgiis6cli.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "3044dceb632b636563f66fee3aaaf8f3"
		id = "2bc59a6b-f45c-5e68-a346-ac56e8f2757b"
	strings:
		$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
		$s5 = "###command:(NO more than 100 bytes!)"
	condition:
		all of them
}
YARA Detection Rule: remview_2003_04_22
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file remview_2003_04_22.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "\"<b>\".mm(\"Eval PHP code\").\"</b> (\".mm(\"don't type\").\" \\\"&lt;?\\\""

Detection condition:
all of them

Full rule:
rule remview_2003_04_22 {
	meta:
		description = "Webshells Auto-generated - file remview_2003_04_22.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "17d3e4e39fbca857344a7650f7ea55e3"
		id = "3088ee27-42a3-5140-98de-ab6f87c7748b"
	strings:
		$s1 = "\"<b>\".mm(\"Eval PHP code\").\"</b> (\".mm(\"don't type\").\" \\\"&lt;?\\\""
	condition:
		all of them
}
YARA Detection Rule: FSO_s_test
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file test.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "$yazi = \"test\" . \"\\r\\n\";"
		$s2 = "fwrite ($fp, \"$yazi\");"

Detection condition:
all of them

Full rule:
rule FSO_s_test {
	meta:
		description = "Webshells Auto-generated - file test.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "82cf7b48da8286e644f575b039a99c26"
		id = "b0cc5a2a-c741-50dd-854f-5a43769e8f47"
	strings:
		$s0 = "$yazi = \"test\" . \"\\r\\n\";"
		$s2 = "fwrite ($fp, \"$yazi\");"
	condition:
		all of them
}
YARA Detection Rule: Debug_cress
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file cress.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "\\Mithril "
		$s4 = "Mithril.exe"

Detection condition:
all of them

Full rule:
rule Debug_cress {
	meta:
		description = "Webshells Auto-generated - file cress.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "36a416186fe010574c9be68002a7286a"
		id = "6cf3e43c-bec1-5688-b1d7-8ac48d59153a"
	strings:
		$s0 = "\\Mithril "
		$s4 = "Mithril.exe"
	condition:
		all of them
}
YARA Detection Rule: webshell
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file webshell.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "RhViRYOzz"
		$s1 = "d\\O!jWW"
		$s2 = "bc!jWW"
		$s3 = "0W[&{l"
		$s4 = "[INhQ@\\"

Detection condition:
all of them

Full rule:
rule webshell {
	meta:
		description = "Webshells Auto-generated - file webshell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "f2f8c02921f29368234bfb4d4622ad19"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "RhViRYOzz"
		$s1 = "d\\O!jWW"
		$s2 = "bc!jWW"
		$s3 = "0W[&{l"
		$s4 = "[INhQ@\\"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_EFSO_2
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file EFSO_2.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = ";!+/DRknD7+.\\mDrC(V+kcJznndm\\f|nzKuJb'r@!&0KUY@*Jb@#@&Xl\"dKVcJ\\CslU,),@!0KxD~mKV"
		$s4 = "\\co!VV2CDtSJ'E*#@#@&mKx/DP14lM/nY{JC81N+6LtbL3^hUWa;M/OE-AXX\"b~/fAs!u&9|J\\grKp\"j"

Detection condition:
all of them

Full rule:
rule FSO_s_EFSO_2 {
	meta:
		description = "Webshells Auto-generated - file EFSO_2.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "a341270f9ebd01320a7490c12cb2e64c"
		id = "e88d324c-1dee-5b07-b528-cf760e3ee7a6"
	strings:
		$s0 = ";!+/DRknD7+.\\mDrC(V+kcJznndm\\f|nzKuJb'r@!&0KUY@*Jb@#@&Xl\"dKVcJ\\CslU,),@!0KxD~mKV"
		$s4 = "\\co!VV2CDtSJ'E*#@#@&mKx/DP14lM/nY{JC81N+6LtbL3^hUWa;M/OE-AXX\"b~/fAs!u&9|J\\grKp\"j"
	condition:
		all of them
}
YARA Detection Rule: thelast_index3
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file index3.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s5 = "$err = \"<i>Your Name</i> Not Entered!</font></h2>Sorry, \\\"Your Name\\\" field is r"

Detection condition:
all of them

Full rule:
rule thelast_index3 {
	meta:
		description = "Webshells Auto-generated - file index3.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "cceff6dc247aaa25512bad22120a14b4"
		id = "41310217-b9a7-5360-80c4-7d0a3969f848"
	strings:
		$s5 = "$err = \"<i>Your Name</i> Not Entered!</font></h2>Sorry, \\\"Your Name\\\" field is r"
	condition:
		all of them
}
YARA Detection Rule: adjustcr
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file adjustcr.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "$Info: This file is packed with the UPX executable packer $"
		$s2 = "$License: NRV for UPX is distributed under special license $"
		$s6 = "AdjustCR Carr"
		$s7 = "ION\\System\\FloatingPo"

Detection condition:
all of them

Full rule:
rule adjustcr {
	meta:
		description = "Webshells Auto-generated - file adjustcr.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "17037fa684ef4c90a25ec5674dac2eb6"
		id = "4b3d9409-60e8-502a-b37b-1e06d57c9b0b"
	strings:
		$s0 = "$Info: This file is packed with the UPX executable packer $"
		$s2 = "$License: NRV for UPX is distributed under special license $"
		$s6 = "AdjustCR Carr"
		$s7 = "ION\\System\\FloatingPo"
	condition:
		all of them
}
YARA Detection Rule: FeliksPack3___PHP_Shells_xIShell
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file xIShell.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s3 = "if (!$nix) { $xid = implode(explode(\"\\\\\",$xid),\"\\\\\\\\\");}echo (\"<td><a href='Java"

Detection condition:
all of them

Full rule:
rule FeliksPack3___PHP_Shells_xIShell {
	meta:
		description = "Webshells Auto-generated - file xIShell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "997c8437c0621b4b753a546a53a88674"
		id = "32a32a9a-8d5f-5b3f-8ff4-560555f0ae1e"
	strings:
		$s3 = "if (!$nix) { $xid = implode(explode(\"\\\\\",$xid),\"\\\\\\\\\");}echo (\"<td><a href='Java"
	condition:
		all of them
}
YARA Detection Rule: HYTop_AppPack_2005
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file 2005.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s6 = "\" onclick=\"this.form.sqlStr.value='e:\\hytop.mdb"

Detection condition:
all of them

Full rule:
rule HYTop_AppPack_2005 {
	meta:
		description = "Webshells Auto-generated - file 2005.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "63d9fd24fa4d22a41fc5522fc7050f9f"
		id = "67c86d16-a962-5502-8c39-0a6e3dc04031"
	strings:
		$s6 = "\" onclick=\"this.form.sqlStr.value='e:\\hytop.mdb"
	condition:
		all of them
}
YARA Detection Rule: xssshell
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file xssshell.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "if( !getRequest(COMMANDS_URL + \"?v=\" + VICTIM + \"&r=\" + generateID(), \"pushComma"

Detection condition:
all of them

Full rule:
rule xssshell {
	meta:
		description = "Webshells Auto-generated - file xssshell.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "8fc0ffc5e5fbe85f7706ffc45b3f79b4"
		id = "ef89653c-5814-525a-b04e-4326a80f780c"
	strings:
		$s1 = "if( !getRequest(COMMANDS_URL + \"?v=\" + VICTIM + \"&r=\" + generateID(), \"pushComma"
	condition:
		all of them
}
YARA Detection Rule: FeliksPack3___PHP_Shells_usr
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file usr.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "<?php $id_info = array('notify' => 'off','sub' => 'aasd','s_name' => 'nurullahor"

Detection condition:
all of them

Full rule:
rule FeliksPack3___PHP_Shells_usr {
	meta:
		description = "Webshells Auto-generated - file usr.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "ade[PII_REDACTED]af50c9098dc8a21a024"
		id = "ab1825fe-96aa-5d97-acd6-eac43a12b237"
	strings:
		$s0 = "<?php $id_info = array('notify' => 'off','sub' => 'aasd','s_name' => 'nurullahor"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_phpinj
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file phpinj.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s4 = "echo '<a href='.$expurl.'> Click Here to Exploit </a> <br />';"

Detection condition:
all of them

Full rule:
rule FSO_s_phpinj {
	meta:
		description = "Webshells Auto-generated - file phpinj.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "dd39d17e9baca0363cc1c3664e608929"
		id = "5d84d518-0e18-517f-890b-e296ac265c50"
	strings:
		$s4 = "echo '<a href='.$expurl.'> Click Here to Exploit </a> <br />';"
	condition:
		all of them
}
YARA Detection Rule: xssshell_db
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file db.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s8 = "'// By Ferruh Mavituna | http://ferruh.mavituna.com"

Detection condition:
all of them

Full rule:
rule xssshell_db {
	meta:
		description = "Webshells Auto-generated - file db.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "cb62e2ec40addd4b9930a9e270f5b318"
		id = "94bb2297-95a2-5442-bb16-fb079a29606e"
	strings:
		$s8 = "'// By Ferruh Mavituna | http://ferruh.mavituna.com"
	condition:
		all of them
}
YARA Detection Rule: PHP_sh
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file sh.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "\"@$SERVER_NAME \".exec(\"pwd\")"

Detection condition:
all of them

Full rule:
rule PHP_sh {
	meta:
		description = "Webshells Auto-generated - file sh.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "1e9e879d49eb0634871e9b36f99fe528"
		id = "08dff4db-3b1c-5702-a8c9-efaedf83c4ff"
	strings:
		$s1 = "\"@$SERVER_NAME \".exec(\"pwd\")"
	condition:
		all of them
}