deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Android_Malware
Repository: Yara-Rules/rules
Detects: Match first two bytes, files and string present in iBanking
Author: Xylitol xylitol@malwareint.com
Reference: http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3166

Pattern signatures:
// Generic android
		$pk = {50 4B}
		$file1 = "AndroidManifest.xml"
		// iBanking related
		$file2 = "res/drawable-xxhdpi/ok_btn.jpg"
		$string1 = "bot_id"
		$string2 = "type_password2"

Detection condition:
($pk at 0 and 2 of ($file*) and ($string1 or $string2))

Full rule:
rule Android_Malware : iBanking android
{
	meta:
		author = "Xylitol xylitol@malwareint.com"
		date = "2014-02-14"
		description = "Match first two bytes, files and string present in iBanking"
		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3166"
		
	strings:
		// Generic android
		$pk = {50 4B}
		$file1 = "AndroidManifest.xml"
		// iBanking related
		$file2 = "res/drawable-xxhdpi/ok_btn.jpg"
		$string1 = "bot_id"
		$string2 = "type_password2"
	condition:
		($pk at 0 and 2 of ($file*) and ($string1 or $string2))
}
YARA Detection Rule: Installer
Repository: Yara-Rules/rules
Detects: Applications with Installer as an application name
Author: https://twitter.com/plutec_net
Reference: https://koodous.com/

Detection condition:
androguard.package_name("Jk7H.PwcD")

Full rule:
rule Installer: banker android
{
	meta:
		author = "https://twitter.com/plutec_net"
		reference = "https://koodous.com/"
		description = "Applications with Installer as an application name"

	condition:
		androguard.package_name("Jk7H.PwcD")
}
YARA Detection Rule: genericSMS
Repository: Yara-Rules/rules
Author: https://twitter.com/plutec_net
Reference: https://koodous.com/

Pattern signatures:
$a = "SHA1-Digest: +RsrTx5SNjstrnt7pNaeQAzY4kc="
		$b = "SHA1-Digest: Rt2oRts0wWTjffGlETGfFix1dfE="
		$c = "http://image.baidu.com/wisebrowse/index?tag1=%E6%98%8E%E6%98%9F&tag2=%E5%A5%B3%E6%98%8E%E6%98%9F&tag3=%E5%85%A8%E9%83%A8&pn=0&rn=10&fmpage=index&pos=magic#/channel"
		$d = "pitchfork=022D4"

Detection condition:
all of them

Full rule:
rule genericSMS : smsFraud android
{
	meta:
	    	author = "https://twitter.com/plutec_net"
            	reference = "https://koodous.com/"
	    	sample = "3fc533d832e22dc3bc161e5190edf242f70fbc4764267ca073de5a8e3ae23272"
	    	sample2 = "3d85bdd0faea9c985749c614a0676bb05f017f6bde3651f2b819c7ac40a02d5f"

	strings:
		$a = "SHA1-Digest: +RsrTx5SNjstrnt7pNaeQAzY4kc="
		$b = "SHA1-Digest: Rt2oRts0wWTjffGlETGfFix1dfE="
		$c = "http://image.baidu.com/wisebrowse/index?tag1=%E6%98%8E%E6%98%9F&tag2=%E5%A5%B3%E6%98%8E%E6%98%9F&tag3=%E5%85%A8%E9%83%A8&pn=0&rn=10&fmpage=index&pos=magic#/channel"
		$d = "pitchfork=022D4"

	condition:
		all of them
		
}
YARA Detection Rule: genericSMS2
Repository: Yara-Rules/rules
Author: https://twitter.com/plutec_net
Reference: https://koodous.com/

Pattern signatures:
$a = "NotLeftTriangleEqual=022EC"
		$b = "SHA1-Digest: X27Zpw9c6eyXvEFuZfCL2LmumtI="
		$c = "_ZNSt12_Vector_baseISsSaISsEE13_M_deallocateEPSsj"
		$d = "FBTP2AHR3WKC6LEYON7D5GZXVISMJ4QU"

Detection condition:
all of them

Full rule:
rule genericSMS2 : smsFraud android
{
	meta:
		author = "https://twitter.com/plutec_net"
                reference = "https://koodous.com/"
		sample = "1f23524e32c12c56be0c9a25c69ab7dc21501169c57f8d6a95c051397263cf9f"
		sample2 = "2cf073bd8de8aad6cc0d6ad5c98e1ba458bd0910b043a69a25aabdc2728ea2bd"
		sample3 = "20575a3e5e97bcfbf2c3c1d905d967e91a00d69758eb15588bdafacb4c854cba"

	strings:
		$a = "NotLeftTriangleEqual=022EC"
		$b = "SHA1-Digest: X27Zpw9c6eyXvEFuZfCL2LmumtI="
		$c = "_ZNSt12_Vector_baseISsSaISsEE13_M_deallocateEPSsj"
		$d = "FBTP2AHR3WKC6LEYON7D5GZXVISMJ4QU"

	condition:
		all of them
		
}
YARA Detection Rule: SlemBunk
Repository: Yara-Rules/rules
Detects: Rule to detect trojans imitating banks of North America, Eurpope and Asia
Author: @plutec_net

Pattern signatures:
$a = "#intercept_sms_start"
		$b = "#intercept_sms_stop"
		$c = "#block_numbers"
		$d = "#wipe_data"
		$e = "Visa Electron"

Detection condition:
all of them

Full rule:
rule SlemBunk : android
{
	meta:
		description = "Rule to detect trojans imitating banks of North America, Eurpope and Asia"
		author = "@plutec_net"
		sample = "e6ef34577a75fc0dc0a1f473304de1fc3a0d7d330bf58448db5f3108ed92741b"
		source = "https://www.fireeye.com/blog/threat-research/2015/12/slembunk_an_evolvin.html"

	strings:
		$a = "#intercept_sms_start"
		$b = "#intercept_sms_stop"
		$c = "#block_numbers"
		$d = "#wipe_data"
		$e = "Visa Electron"

	condition:
		all of them
		
}
YARA Detection Rule: Android_OmniRat
Repository: Yara-Rules/rules
Detects: This rule try to detects OmniRat
Author: Jacob Soo Lead Re

Pattern signatures:
$a = "android.engine.apk"

Detection condition:
(androguard.activity(/com.app.MainActivity/i) and 
		 androguard.permission(/android.permission.WRITE_EXTERNAL_STORAGE/i) and 
		 androguard.package_name(/com.app/i)) and $a

Full rule:
rule Android_OmniRat
{
	meta:
		author = "Jacob Soo Lead Re"
		date = "01-July-2016"
		description = "This rule try to detects OmniRat"
		source = "https://blog.avast.com/2015/11/05/droidjack-isnt-the-only-spying-software-out-there-avast-discovers-that-omnirat-is-currently-being-used-and-spread-by-criminals-to-gain-full-remote-co"

	strings:
		$a = "android.engine.apk"
	condition:
		(androguard.activity(/com.app.MainActivity/i) and 
		 androguard.permission(/android.permission.WRITE_EXTERNAL_STORAGE/i) and 
		 androguard.package_name(/com.app/i)) and $a
}
YARA Detection Rule: Android_Clicker_G
Repository: Yara-Rules/rules
Detects: This rule try to detects Clicker.G samples
Author: Jacob Soo Lead Re
Reference: https://blogs.mcafee.com/mcafee-labs/android-malware-clicker-dgen-found-google-play/

Pattern signatures:
$a = "upd.php?text="

Detection condition:
androguard.receiver(/MyBroadCastReceiver/i) and $a

Full rule:
rule Android_Clicker_G
{
	meta:
		author = "Jacob Soo Lead Re"
		date = "01-July-2016"
		description = "This rule try to detects Clicker.G samples"
		reference = "https://blogs.mcafee.com/mcafee-labs/android-malware-clicker-dgen-found-google-play/"
	strings:
		$a = "upd.php?text="
	condition:
		androguard.receiver(/MyBroadCastReceiver/i) and $a
}
YARA Detection Rule: andr_sk_bank
Repository: Yara-Rules/rules
Detects: Yara rule for Banking trojan targeting South Korean banks
Author: https://twitter.com/5h1vang

Pattern signatures:
$str_1 = "NPKI"
		$str_2 = "portraitCallBack("
		$str_3 = "android.app.extra.DEVICE_ADMIN"
		$str_4 = "SMSReceiver&imsi="
		$str_5 = "com.ahnlab.v3mobileplus"

Detection condition:
androguard.package_name("com.qbjkyd.rhsxa") or
		androguard.certificate.sha1("543382EDDAFC05B435F13BBE97037BB335C2948B") or
		(androguard.permission(/android.permission.RECEIVE_SMS/) and
		androguard.permission(/android.permission.INTERNET/) and 
		androguard.permission(/android.permission.RECEIVE_B

Full rule:
rule andr_sk_bank
{
	meta:
		description = "Yara rule for Banking trojan targeting South Korean banks"
		sample = "0af5c4c2f39aba06f6793f26d6caae134564441b2134e0b72536e65a62bcbfad"
		source = "https://www.zscaler.com/blogs/research/android-malware-targeting-south-korean-mobile-users"
		author = "https://twitter.com/5h1vang"

	strings:
		$str_1 = "NPKI"
		$str_2 = "portraitCallBack("
		$str_3 = "android.app.extra.DEVICE_ADMIN"
		$str_4 = "SMSReceiver&imsi="
		$str_5 = "com.ahnlab.v3mobileplus"

	condition:
		androguard.package_name("com.qbjkyd.rhsxa") or
		androguard.certificate.sha1("543382EDDAFC05B435F13BBE97037BB335C2948B") or
		(androguard.permission(/android.permission.RECEIVE_SMS/) and
		androguard.permission(/android.permission.INTERNET/) and 
		androguard.permission(/android.permission.RECEIVE_BOOT_COMPLETED/) and 
		all of ($str_*))
}
YARA Detection Rule: BaDoink
Repository: Yara-Rules/rules
Detects: Virus de la Policia - android
Author: Fernando Denis https://twitter.com/fdrg21
Reference: https://koodous.com/

Pattern signatures:
//$url_string_1 = "http://police-mobile-stop.com"
		//$url_string_2 = "http://mobile-policeblock.com"
		
		$type_a_1 ="6589y459gj4058rt"
	
		$type_b_1 = "Q,hu4P#hT;U!XO7T,uD"
		$type_b_2 = "+Gkwg#M!lf>Laq&+J{lg"

//		$type_c_1 = "ANIM_STYLE_CLOSE_ENTER"
//		$type_c_2 = "TYPE_VIEW_ACCESSIBILITY_FOCUSED"
//		$type_c_3 = "TYPE_VIEW_TEXT_SELECTION_CHANGED"
//		$type_c_4 = "FLAG_REQUEST_ENHANCED_WEB_ACCESSIBILITY"

Detection condition:
androguard.app_name("BaDoink") or
		//all of ($url_string_*) or
		$type_a_1 or
		all of ($type_b*) 
//		all of ($type_c_*)

Full rule:
rule BaDoink : official android
{
		meta:
		author = "Fernando Denis https://twitter.com/fdrg21"
		reference = "https://koodous.com/"
		description = "Virus de la Policia - android"
		sample = "9bc0fb0f05bbf25507104a4eb74e8066b194a8e6a57670957c0ad1af92189921"

	strings:
		
		//$url_string_1 = "http://police-mobile-stop.com"
		//$url_string_2 = "http://mobile-policeblock.com"
		
		$type_a_1 ="6589y459gj4058rt"
	
		$type_b_1 = "Q,hu4P#hT;U!XO7T,uD"
		$type_b_2 = "+Gkwg#M!lf>Laq&+J{lg"

//		$type_c_1 = "ANIM_STYLE_CLOSE_ENTER"
//		$type_c_2 = "TYPE_VIEW_ACCESSIBILITY_FOCUSED"
//		$type_c_3 = "TYPE_VIEW_TEXT_SELECTION_CHANGED"
//		$type_c_4 = "FLAG_REQUEST_ENHANCED_WEB_ACCESSIBILITY"

	condition:
		androguard.app_name("BaDoink") or
		//all of ($url_string_*) or
		$type_a_1 or
		all of ($type_b*) 
//		all of ($type_c_*)
		
}
YARA Detection Rule: CryptoWall_Resume_phish
Repository: Yara-Rules/rules
Author: http://phishme.com/
Reference: https://github.com/phishme/malware_analysis/blob/master/yara_rules/cryptowall.yar

Pattern signatures:
$hello2="my name is " nocase
    $file1="resume attached" nocase
    $file2="my resume is pdf file" nocase
    $file3="attached is my resume" nocase
    $sal1="I would appreciate your " nocase
    $sal2="I am looking forward to hearing from you" nocase
    $sal3="I look forward to your reply" nocase
    $sal4="Please message me back" nocase
    $sal5="our early reply will be appreciated" nocase
    $file4="attach is my resume" nocase
    $file5="PDF file is my resume" nocase
    $sal6="Looking forward to see your response" nocase

Detection condition:
1 of ($hello*) and 1 of ($file*) and 1 of ($sal*)

Full rule:
rule CryptoWall_Resume_phish : mail
{
  meta:
		Author = "http://phishme.com/"
		reference = "https://github.com/phishme/malware_analysis/blob/master/yara_rules/cryptowall.yar"
  strings:
    $hello2="my name is " nocase
    $file1="resume attached" nocase
    $file2="my resume is pdf file" nocase
    $file3="attached is my resume" nocase
    $sal1="I would appreciate your " nocase
    $sal2="I am looking forward to hearing from you" nocase
    $sal3="I look forward to your reply" nocase
    $sal4="Please message me back" nocase
    $sal5="our early reply will be appreciated" nocase
    $file4="attach is my resume" nocase
    $file5="PDF file is my resume" nocase
    $sal6="Looking forward to see your response" nocase

  condition:
    1 of ($hello*) and 1 of ($file*) and 1 of ($sal*)
}
YARA Detection Rule: docx_macro
Repository: Yara-Rules/rules

Pattern signatures:
$header="PK" 
    $vbaStrings="word/vbaProject.bin" nocase

Detection condition:
$header at 0 and $vbaStrings

Full rule:
rule docx_macro : mail
{
  strings:
    $header="PK" 
    $vbaStrings="word/vbaProject.bin" nocase

  condition:
    $header at 0 and $vbaStrings
}
YARA Detection Rule: with_urls
Repository: Yara-Rules/rules
Detects: Rule to detect the presence of an or several urls
Author: Antonio Sanchez <asanchez@hispasec.com>
Reference: http://laboratorio.blogs.hispasec.com/

Pattern signatures:
$eml_01 = "From:"
                $eml_02 = "To:"
                $eml_03 = "Subject:"

		$url_regex = /https?:\/\/([\w\.-]+)([\/\w \.-]*)/

Detection condition:
all of them

Full rule:
rule with_urls : mail {
	meta:
		author = "Antonio Sanchez <asanchez@hispasec.com>"
		reference = "http://laboratorio.blogs.hispasec.com/"
		description = "Rule to detect the presence of an or several urls"
	strings:
                $eml_01 = "From:"
                $eml_02 = "To:"
                $eml_03 = "Subject:"

		$url_regex = /https?:\/\/([\w\.-]+)([\/\w \.-]*)/
	condition:
		all of them
}
YARA Detection Rule: without_urls
Repository: Yara-Rules/rules
Detects: Rule to detect the no presence of any url
Author: Antonio Sanchez <asanchez@hispasec.com>
Reference: http://laboratorio.blogs.hispasec.com/

Pattern signatures:
$eml_01 = "From:"
                $eml_02 = "To:"
                $eml_03 = "Subject:"

		$url_regex = /https?:\/\/([\w\.-]+)([\/\w \.-]*)/

Detection condition:
all of ( $eml_* ) and
		not $url_regex

Full rule:
rule without_urls : mail {
	meta:
		author = "Antonio Sanchez <asanchez@hispasec.com>"
		reference = "http://laboratorio.blogs.hispasec.com/"
		description = "Rule to detect the no presence of any url"
	strings:
                $eml_01 = "From:"
                $eml_02 = "To:"
                $eml_03 = "Subject:"

		$url_regex = /https?:\/\/([\w\.-]+)([\/\w \.-]*)/
	condition:
                all of ( $eml_* ) and
		not $url_regex
}
YARA Detection Rule: with_images
Repository: Yara-Rules/rules
Detects: Rule to detect the presence of an or several images
Author: Antonio Sanchez <asanchez@hispasec.com>
Reference: http://laboratorio.blogs.hispasec.com/

Pattern signatures:
$eml_01 = "From:"
                $eml_02 = "To:"
                $eml_03 = "Subject:"
		$img_a = ".jpg" nocase
		$img_b = ".png" nocase
		$img_c = ".bmp" nocase

Detection condition:
all of ( $eml_* ) and
		any of ( $img_* )

Full rule:
rule with_images : mail {
	meta:
		author = "Antonio Sanchez <asanchez@hispasec.com>"
		reference = "http://laboratorio.blogs.hispasec.com/"
		description = "Rule to detect the presence of an or several images"
	strings:
                $eml_01 = "From:"
                $eml_02 = "To:"
                $eml_03 = "Subject:"
		$img_a = ".jpg" nocase
		$img_b = ".png" nocase
		$img_c = ".bmp" nocase
	condition:
                all of ( $eml_* ) and
		any of ( $img_* )
}
YARA Detection Rule: without_images
Repository: Yara-Rules/rules
Detects: Rule to detect the no presence of any image
Author: Antonio Sanchez <asanchez@hispasec.com>
Reference: http://laboratorio.blogs.hispasec.com/

Pattern signatures:
$eml_01 = "From:"
                $eml_02 = "To:"
                $eml_03 = "Subject:"

		$a = ".jpg" nocase
		$b = ".png" nocase
		$c = ".bmp" nocase

Detection condition:
all of ( $eml_* ) and
		not $a and not $b and not $c

Full rule:
rule without_images : mail {
	meta:
		author = "Antonio Sanchez <asanchez@hispasec.com>"
		reference = "http://laboratorio.blogs.hispasec.com/"
		description = "Rule to detect the no presence of any image"
	strings:
                $eml_01 = "From:"
                $eml_02 = "To:"
                $eml_03 = "Subject:"

		$a = ".jpg" nocase
		$b = ".png" nocase
		$c = ".bmp" nocase
	condition:
                all of ( $eml_* ) and
		not $a and not $b and not $c
}
YARA Detection Rule: with_attachment
Repository: Yara-Rules/rules
Detects: Rule to detect the presence of an or several attachments
Author: Antonio Sanchez <asanchez@hispasec.com>
Reference: http://laboratorio.blogs.hispasec.com/

Pattern signatures:
$attachment_id = "X-Attachment-Id"

Detection condition:
$attachment_id

Full rule:
rule with_attachment : mail {
	meta:
		author = "Antonio Sanchez <asanchez@hispasec.com>"
		reference = "http://laboratorio.blogs.hispasec.com/"
		description = "Rule to detect the presence of an or several attachments"
	strings:
		$attachment_id = "X-Attachment-Id"
	condition:
		$attachment_id
}
YARA Detection Rule: without_attachments
Repository: Yara-Rules/rules
Detects: Rule to detect the no presence of any attachment
Author: Antonio Sanchez <asanchez@hispasec.com>
Reference: http://laboratorio.blogs.hispasec.com/

Pattern signatures:
$eml_01 = "From:"
                $eml_02 = "To:"
                $eml_03 = "Subject:"
		$attachment_id = "X-Attachment-Id"
                $mime_type = "Content-Type: multipart/mixed"

Detection condition:
all of ( $eml_* ) and
		not $attachment_id and 
                not $mime_type

Full rule:
rule without_attachments : mail {
	meta:
		author = "Antonio Sanchez <asanchez@hispasec.com>"
		reference = "http://laboratorio.blogs.hispasec.com/"
		description = "Rule to detect the no presence of any attachment"
	strings:
                $eml_01 = "From:"
                $eml_02 = "To:"
                $eml_03 = "Subject:"
		$attachment_id = "X-Attachment-Id"
                $mime_type = "Content-Type: multipart/mixed"
	condition:
                all of ( $eml_* ) and
		not $attachment_id and 
                not $mime_type
}
YARA Detection Rule: extortion_email
Repository: Yara-Rules/rules
Detects: Detects the possible extortion scam on the basis of subjects and keywords
Author: milann shrestha <Twitter - @x0verhaul>

Pattern signatures:
$eml1="From:"
    $eml2="To:"
    $eml3="Subject:"
		
		// Common Subjects scammer keep for luring the targets 
    $sub1 = "Hackers know password from your account."
    $sub2 = "Security Alert. Your accounts were hacked by a criminal group."
    $sub3 = "Your account was under attack! Change your credentials!"
    $sub4 = "The decision to suspend your account. Waiting for payment"
    $sub5 = "Fraudsters know your old passwords. Access data must be changed."
    $sub6 = "Your account has been hacked! You need to unlock it."
    $sub7 = "Be sure to read this message! Your personal data is threatened!"
    $sub8 = "Password must be changed now."

		// Keywords used for extortion
    $key1 = "BTC" nocase
    $key2 = "Wallet" nocase
    $key3 = "Bitcoin" nocase
    $key4 = "hours" nocase
    $key5 = "payment" nocase
    $key6 = "malware" nocase
    $key = "bitcoin address" nocase
    $key7 = "access" nocase
    $key8 = "virus" nocase

Detection condition:
all of ($eml*) and
    any of ($sub*) and
    any of ($key*)

Full rule:
rule extortion_email
{
  meta:
    author = "milann shrestha <Twitter - @x0verhaul>"
		description = "Detects the possible extortion scam on the basis of subjects and keywords"
		data = "12th May 2020"

	strings:
	  $eml1="From:"
    $eml2="To:"
    $eml3="Subject:"
		
		// Common Subjects scammer keep for luring the targets 
    $sub1 = "Hackers know password from your account."
    $sub2 = "Security Alert. Your accounts were hacked by a criminal group."
    $sub3 = "Your account was under attack! Change your credentials!"
    $sub4 = "The decision to suspend your account. Waiting for payment"
    $sub5 = "Fraudsters know your old passwords. Access data must be changed."
    $sub6 = "Your account has been hacked! You need to unlock it."
    $sub7 = "Be sure to read this message! Your personal data is threatened!"
    $sub8 = "Password must be changed now."

		// Keywords used for extortion
    $key1 = "BTC" nocase
    $key2 = "Wallet" nocase
    $key3 = "Bitcoin" nocase
    $key4 = "hours" nocase
    $key5 = "payment" nocase
    $key6 = "malware" nocase
    $key = "bitcoin address" nocase
    $key7 = "access" nocase
    $key8 = "virus" nocase

	condition: 
    all of ($eml*) and
    any of ($sub*) and
    any of ($key*)
}
YARA Detection Rule: email_Ukraine_power_attack_content
Repository: Yara-Rules/rules
Detects: Detects a possible .eml used in the Ukraine BE power attack
Author: @mmorenog,@yararules

Pattern signatures:
$subject = "=?windows-1251?B?0+rg5yDP8OXn6OTl7fLgINPq8OC/7egguSAx?=" 
		$body_string1 = "=E5=E7=E8=E4=E5=ED=F2=E0 =D3=EA=F0=E0=BF=ED=E8 =F2=E0 =EF=EE=F0=FF=E4=EE=EA="
		$body_string2 = "=B3 =C7=E1=F0=EE=E9=ED=E8=F5 =D1=E8=EB =D3=EA=F0=E0=BF=ED=E8 =F2=E0=20"
		$body_string3 = "=E1=B3=F2=ED=E8=EA=B3=E2 =EE=F0=E3=E0=ED=B3=E7=E0=F6=B3=E9 =E7=E0 =E7=F0=E0="
		$body_string4 = "http://176.53.127.194/bWFpbF9rYW5jQG9lLmlmLnVh.png"
		$body_string5 = "=C2=B3=E4=EF=EE=E2=B3=E4=ED=EE =E4=EE =D3=EA=E0=E7=F3 =CF=F0=E5=E7=E8=E4=E5="

Detection condition:
3 of them

Full rule:
rule email_Ukraine_power_attack_content : mail {
	meta:
		author = "@mmorenog,@yararules"
		description = "Detects a possible .eml used in the Ukraine BE power attack"
		ref1 = "https://twitter.com/lowcalspam/status/[PII_REDACTED]94726400"
		
	strings:
		$subject = "=?windows-1251?B?0+rg5yDP8OXn6OTl7fLgINPq8OC/7egguSAx?=" 
		$body_string1 = "=E5=E7=E8=E4=E5=ED=F2=E0 =D3=EA=F0=E0=BF=ED=E8 =F2=E0 =EF=EE=F0=FF=E4=EE=EA="
		$body_string2 = "=B3 =C7=E1=F0=EE=E9=ED=E8=F5 =D1=E8=EB =D3=EA=F0=E0=BF=ED=E8 =F2=E0=20"
		$body_string3 = "=E1=B3=F2=ED=E8=EA=B3=E2 =EE=F0=E3=E0=ED=B3=E7=E0=F6=B3=E9 =E7=E0 =E7=F0=E0="
		$body_string4 = "http://176.53.127.194/bWFpbF9rYW5jQG9lLmlmLnVh.png"
		$body_string5 = "=C2=B3=E4=EF=EE=E2=B3=E4=ED=EE =E4=EE =D3=EA=E0=E7=F3 =CF=F0=E5=E7=E8=E4=E5="
	condition:
		3 of them
}
YARA Detection Rule: email_Ukraine_power_attack_attachment
Repository: Yara-Rules/rules
Detects: Detects a possible .eml used in the Ukraine BE power attack
Author:  @yararules

Pattern signatures:
$filename = "filename=\"=?windows-1251?B?xO7k4PLu6jEueGxz?=\""

Detection condition:
all of them

Full rule:
rule email_Ukraine_power_attack_attachment : mail {
	meta:
		author = " @yararules"
		description = "Detects a possible .eml used in the Ukraine BE power attack"
		ref1 = "https://twitter.com/lowcalspam/status/[PII_REDACTED]94726400"

	strings:
		$filename = "filename=\"=?windows-1251?B?xO7k4PLu6jEueGxz?=\""
		
		condition:
		all of them
}
YARA Detection Rule: Email_Generic_Phishing
Repository: Yara-Rules/rules
Detects: Generic rule to identify phishing emails
Author: Tyler <@InfoSecTyler>

Pattern signatures:
$eml_1="From:"
    $eml_2="To:"
    $eml_3="Subject:"

    $greeting_1="Hello sir/madam" nocase
    $greeting_2="Attention" nocase
    $greeting_3="Dear user" nocase
    $greeting_4="Account holder" nocase

    $url_1="Click" nocase
    $url_2="Confirm" nocase
    $url_3="Verify" nocase
    $url_4="Here" nocase
    $url_5="Now" nocase
    $url_6="Change password" nocase 

    $lie_1="Unauthorized" nocase
    $lie_2="Expired" nocase
    $lie_3="Deleted" nocase
    $lie_4="Suspended" nocase
    $lie_5="Revoked" nocase
    $lie_6="Unable" nocase

Detection condition:
all of ($eml*) and
    any of ($greeting*) and
    any of ($url*) and
    any of ($lie*)

Full rule:
rule Email_Generic_Phishing : email
{
  meta:
		Author = "Tyler <@InfoSecTyler>"
		Description ="Generic rule to identify phishing emails"

  strings:
    $eml_1="From:"
    $eml_2="To:"
    $eml_3="Subject:"

    $greeting_1="Hello sir/madam" nocase
    $greeting_2="Attention" nocase
    $greeting_3="Dear user" nocase
    $greeting_4="Account holder" nocase

    $url_1="Click" nocase
    $url_2="Confirm" nocase
    $url_3="Verify" nocase
    $url_4="Here" nocase
    $url_5="Now" nocase
    $url_6="Change password" nocase 

    $lie_1="Unauthorized" nocase
    $lie_2="Expired" nocase
    $lie_3="Deleted" nocase
    $lie_4="Suspended" nocase
    $lie_5="Revoked" nocase
    $lie_6="Unable" nocase

  condition:
    all of ($eml*) and
    any of ($greeting*) and
    any of ($url*) and
    any of ($lie*)
}