deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: UACME_Akagi_2
Repository: Neo23x0/signature-base
Detects: Detects Windows User Account Control Bypass - from files Akagi32.exe, Akagi64.exe
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/hfiref0x/UACME

Pattern signatures:
$x1 = "Usage: Akagi.exe [Method] [OptionalParamToExecute]" fullword wide
      $x2 = "[UCM] Target file already exists, abort" fullword wide

      $s1 = "MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options" fullword wide
      $s2 = "Akagi.exe" fullword wide
      $s3 = "Elevation:Administrator!new:{3AD05575-8857-4850-9277-11B85BDB8E09}" fullword wide
      $s4 = "/c wusa %ws /extract:%%windir%%\\system32\\sysprep" fullword wide
      $s5 = "/c wusa %ws /extract:%%windir%%\\system32\\migwiz" fullword wide
      $s6 = "loadFrom=\"%systemroot%\\system32\\sysprep\\cryptbase.DLL\"" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 900KB and ( 1 of ($x*) or 3 of ($s*) ) ) or ( 6 of them )

Full rule:
rule UACME_Akagi_2 {
   meta:
      description = "Detects Windows User Account Control Bypass - from files Akagi32.exe, Akagi64.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/hfiref0x/UACME"
      date = "2017-02-03"
      hash1 = "caf744d38820accb48a6e50216e547ed2bb[PII_REDACTED]dbcfcc991ce5e18f4ca"
      hash2 = "609e9b15114e54ffc40c05a8980cc90f436a4a77c69f3e32fe391c0b130ff1c5"
      score = 80
      id = "1177d663-1081-5d17-9dd7-1218d95d90f7"
   strings:
      $x1 = "Usage: Akagi.exe [Method] [OptionalParamToExecute]" fullword wide
      $x2 = "[UCM] Target file already exists, abort" fullword wide

      $s1 = "MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options" fullword wide
      $s2 = "Akagi.exe" fullword wide
      $s3 = "Elevation:Administrator!new:{3AD05575-8857-4850-9277-11B85BDB8E09}" fullword wide
      $s4 = "/c wusa %ws /extract:%%windir%%\\system32\\sysprep" fullword wide
      $s5 = "/c wusa %ws /extract:%%windir%%\\system32\\migwiz" fullword wide
      $s6 = "loadFrom=\"%systemroot%\\system32\\sysprep\\cryptbase.DLL\"" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 900KB and ( 1 of ($x*) or 3 of ($s*) ) ) or ( 6 of them )
}
YARA Detection Rule: SUSP_RAR_Single_Doc_File
Repository: Neo23x0/signature-base
Detects: Detects suspicious RAR files that contain nothing but a single .doc file
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = ".doc"

Detection condition:
uint16(0) == 0x6152 and
      filesize < 4000KB and
      $s1 at (
         uint16(5) +  // header size
         uint16(uint16(5)+5) +  // rar header size
         uint16(uint16(5) + uint16(uint16(5)+5) + 5)  // rar block size
         - 9  // offset
      ) and (
         // single rar block for a 

Full rule:
rule SUSP_RAR_Single_Doc_File {
   meta:
      description = "Detects suspicious RAR files that contain nothing but a single .doc file"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2020-07-11"
      score = 40
      id = "92dc3a5d-d12c-56d3-8531-25b3da1e1595"
   strings:
      $s1 = ".doc"
   condition:
      uint16(0) == 0x6152 and
      filesize < 4000KB and
      $s1 at (
         uint16(5) +  // header size
         uint16(uint16(5)+5) +  // rar header size
         uint16(uint16(5) + uint16(uint16(5)+5) + 5)  // rar block size
         - 9  // offset
      ) and (
         // single rar block for a single doc file
         uint16(5) +  // header size
         uint16(uint16(5)+5) +  // rar header size
         uint16(uint16(5) + uint16(uint16(5)+5) + 5) +  // rar block size
         uint32(uint16(5) + uint16(uint16(5)+5) + 7)  // raw data size
         > filesize-8
      )
}
YARA Detection Rule: apt28_win_zebrocy_golang_loader_modified
Repository: Neo23x0/signature-base
Detects: Detects unpacked modified APT28/Sofacy Zebrocy Golang.
Author: @VK_Intel
Reference: https://www.vkremez.com/2018/12/lets-learn-progression-of-apt28sofacy.html

Pattern signatures:
// Go build
      $go = { 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 }
      $init = { 6d 61 69 6e 2e 69 6e 69 74 }
      $main = "main" ascii wide fullword
      $scr_git = {67 69 74 68 75 62 2e 63 6f 6d 2f 6b 62 69 6e 61}
      $s0 = "os/exec.(*Cmd).Run" fullword ascii
      $s1 = "net/http.(*http2clientConnReadLoop).processHeaders" fullword ascii
      $s2 = "os.MkdirAll" fullword ascii
      $s3 = "os.Getenv" fullword ascii
      $s4 = "os.Create" fullword ascii
      $s5 = "io/ioutil.WriteFile" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and $go and $init and all of ($s*) and #main > 10 and #scr_git > 5

Full rule:
rule apt28_win_zebrocy_golang_loader_modified {
   meta:
      description = "Detects unpacked modified APT28/Sofacy Zebrocy Golang."
      author = "@VK_Intel"
      date = "2018-12-25"
      reference = "https://www.vkremez.com/2018/12/lets-learn-progression-of-apt28sofacy.html"
      id = "cce9ba6c-954c-5b13-a058-cdf7895d63fc"
   strings:
      // Go build
      $go = { 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 }
      $init = { 6d 61 69 6e 2e 69 6e 69 74 }
      $main = "main" ascii wide fullword
      $scr_git = {67 69 74 68 75 62 2e 63 6f 6d 2f 6b 62 69 6e 61}
      $s0 = "os/exec.(*Cmd).Run" fullword ascii
      $s1 = "net/http.(*http2clientConnReadLoop).processHeaders" fullword ascii
      $s2 = "os.MkdirAll" fullword ascii
      $s3 = "os.Getenv" fullword ascii
      $s4 = "os.Create" fullword ascii
      $s5 = "io/ioutil.WriteFile" fullword ascii
   condition:
      uint16(0) == 0x5a4d and $go and $init and all of ($s*) and #main > 10 and #scr_git > 5
}
YARA Detection Rule: HKTL_Koh_TokenStealer
Repository: Neo23x0/signature-base
Detects: The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project.
Author: Will Schroeder (@harmj0y)
Reference: https://github.com/GhostPack/Koh

Pattern signatures:
$x_typelibguid = "4d5350c8-7f8c-47cf-8cde-c752018af17e" ascii

        $s1 = "[*] Already SYSTEM, not elevating" wide fullword
        $s2 = "S-1-[0-59]-\\d{2}-\\d{8,10}-\\d{8,10}-\\d{8,10}-[1-9]\\d{2}" wide
        $s3 = "0x[0-9A-Fa-f]+$" wide
        $s4 = "\\Koh.pdb" ascii

Detection condition:
uint16(0) == 0x5A4D and 1 of ($x*) or 3 of them

Full rule:
rule HKTL_Koh_TokenStealer
{
    meta:
        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project."
        author = "Will Schroeder (@harmj0y)"
        reference = "https://github.com/GhostPack/Koh"
        id = "76b6cc9f-5db7-5e9b-939c-e713bad8137a"
    strings:
        $x_typelibguid = "4d5350c8-7f8c-47cf-8cde-c752018af17e" ascii

        $s1 = "[*] Already SYSTEM, not elevating" wide fullword
        $s2 = "S-1-[0-59]-\\d{2}-\\d{8,10}-\\d{8,10}-\\d{8,10}-[1-9]\\d{2}" wide
        $s3 = "0x[0-9A-Fa-f]+$" wide
        $s4 = "\\Koh.pdb" ascii
    condition:
        uint16(0) == 0x5A4D and 1 of ($x*) or 3 of them
}
YARA Detection Rule: MAL_RANSOM_ContiCrypter
Repository: Neo23x0/signature-base
Detects: Signature for a crypter associated with Conti
Author: James Quinn, Binary Defense

Pattern signatures:
$handoff1 = {4C 8D 05 ?? ?? ?? ?? 48 C7 44 24 28 00 00 00 00 C7 44 24 20 00 00 00 00 e8}
        $handoff2 = {C7 ?? 24 ?? 00 00 00 00 89 44 24 ?? C7 ?? 24 ?? ?? ?? ?? ?? C7 ?? 24 ?? 00 00 00 00 }
        $garbageLoad1 = {53 48 83 EC 20 89 CB 48 8D 0D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 01 D8 48 83 C4 20 5B C3}
        $garbageLoad2 = {55 89 E5 83 EC 18 C7 ?? 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 03 45 08 52 C9 C3}

Detection condition:
1 of ($handoff*) and 1 of ($garbageLoad*)

Full rule:
rule MAL_RANSOM_ContiCrypter {
    meta:
        author = "James Quinn, Binary Defense"
        description = "Signature for a crypter associated with Conti"
        date = "2021-03-17"
        tlp = "White"
        id = "f2a00655-41a2-5614-9c29-3629c93c0e95"
    strings:
        $handoff1 = {4C 8D 05 ?? ?? ?? ?? 48 C7 44 24 28 00 00 00 00 C7 44 24 20 00 00 00 00 e8}
        $handoff2 = {C7 ?? 24 ?? 00 00 00 00 89 44 24 ?? C7 ?? 24 ?? ?? ?? ?? ?? C7 ?? 24 ?? 00 00 00 00 }
        $garbageLoad1 = {53 48 83 EC 20 89 CB 48 8D 0D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 01 D8 48 83 C4 20 5B C3}
        $garbageLoad2 = {55 89 E5 83 EC 18 C7 ?? 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 03 45 08 52 C9 C3}
    condition:
        1 of ($handoff*) and 1 of ($garbageLoad*)
}
YARA Detection Rule: MAL_BackNet_Nov18_1
Repository: Neo23x0/signature-base
Detects: Detects BackNet samples
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/valsov/BackNet

Pattern signatures:
$s1 = "ProcessedByFody" fullword ascii
      $s2 = "SELECT * FROM AntivirusProduct" fullword wide
      $s3 = "/C netsh wlan show profile" wide
      $s4 = "browsertornado" fullword wide
      $s5 = "Current user is administrator" fullword wide
      $s6 = "/C choice /C Y /N /D Y /T 4 & Del" wide
      $s7 = "ThisIsMyMutex-2JUY34DE8E23D7" wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 2000KB and 2 of them

Full rule:
rule MAL_BackNet_Nov18_1 {
   meta:
      description = "Detects BackNet samples"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/valsov/BackNet"
      date = "2018-11-02"
      hash1 = "4ce82644eaa1a00cdb6e2f363743553f2e4bd1eddb8bc84e45eda7c0699d9adc"
      id = "f8575c5a-710d-5e97-91c1-5db454c6baf4"
   strings:
      $s1 = "ProcessedByFody" fullword ascii
      $s2 = "SELECT * FROM AntivirusProduct" fullword wide
      $s3 = "/C netsh wlan show profile" wide
      $s4 = "browsertornado" fullword wide
      $s5 = "Current user is administrator" fullword wide
      $s6 = "/C choice /C Y /N /D Y /T 4 & Del" wide
      $s7 = "ThisIsMyMutex-2JUY34DE8E23D7" wide
   condition:
      uint16(0) == 0x5a4d and filesize < 2000KB and 2 of them
}
YARA Detection Rule: MAL_RANSOM_RobinHood_May19_1
Repository: Neo23x0/signature-base
Detects: Detects RobinHood Ransomware
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/BThurstonCPTECH/status/[PII_REDACTED]27030277

Pattern signatures:
$s1 = ".enc_robbinhood" ascii
      $s2 = "c:\\windows\\temp\\pub.key" ascii fullword
      $s3 = "cmd.exe /c net use * /DELETE /Y" ascii
      $s4 = "sc.exe stop SQLAgent$SQLEXPRESS" nocase
      $s5 = "main.EnableShadowFucks" nocase
      $s6 = "main.EnableRecoveryFCK" nocase
      $s7 = "main.EnableLogLaunders" nocase
      $s8 = "main.EnableServiceFuck" nocase

Detection condition:
uint16(0) == 0x5a4d and filesize < 8000KB and 1 of them

Full rule:
rule MAL_RANSOM_RobinHood_May19_1 {
   meta:
      description = "Detects RobinHood Ransomware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/BThurstonCPTECH/status/[PII_REDACTED]27030277"
      date = "2019-05-15"
      hash1 = "21cb84fc7b33e8e31364ff0e58b078db8f47494a239dc3ccbea8017ff60807e3"
      id = "7199c0de-c925-5399-8fa6-852604190a21"
   strings:
      $s1 = ".enc_robbinhood" ascii
      $s2 = "c:\\windows\\temp\\pub.key" ascii fullword
      $s3 = "cmd.exe /c net use * /DELETE /Y" ascii
      $s4 = "sc.exe stop SQLAgent$SQLEXPRESS" nocase
      $s5 = "main.EnableShadowFucks" nocase
      $s6 = "main.EnableRecoveryFCK" nocase
      $s7 = "main.EnableLogLaunders" nocase
      $s8 = "main.EnableServiceFuck" nocase
   condition:
      uint16(0) == 0x5a4d and filesize < 8000KB and 1 of them
}
YARA Detection Rule: MAL_GoziCrypter_Dec20_1
Repository: Neo23x0/signature-base
Detects: Detects crypter associated with several Gozi samples
Author: James Quinn
Reference: YaraExchange

Pattern signatures:
$s1 = { 89 05 ?? ?? ?? ?? 81 2d ?? ?? ?? ?? 01 00 00 00 81 3D ?? ?? ?? ?? 00 00 00 00 }

Detection condition:
uint16(0) == 0x5A4D and any of them and filesize < 1000KB

Full rule:
rule MAL_GoziCrypter_Dec20_1 {
    meta:
      description = "Detects crypter associated with several Gozi samples"
      author = "James Quinn"
      reference = "YaraExchange"
      score = 70
      id = "d4a48612-fa6f-5f03-8d27-5f6b79b2a070"
    strings:
      $s1 = { 89 05 ?? ?? ?? ?? 81 2d ?? ?? ?? ?? 01 00 00 00 81 3D ?? ?? ?? ?? 00 00 00 00 }
    condition:
      uint16(0) == 0x5A4D and any of them and filesize < 1000KB
}
YARA Detection Rule: Beacon_K5om
Repository: Neo23x0/signature-base
Detects: Detects Meterpreter Beacon - file K5om.dll
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html

Pattern signatures:
$x1 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
      $x2 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
      $x3 = "%d is an x86 process (can't inject x64 content)" fullword ascii

      $s1 = "Could not open process token: %d (%u)" fullword ascii
      $s2 = "0fd00b.dll" fullword ascii
      $s3 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" fullword ascii
      $s4 = "Could not connect to pipe (%s): %d" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 600KB and ( 1 of ($x*) or 3 of them ) )

Full rule:
rule Beacon_K5om {
   meta:
      description = "Detects Meterpreter Beacon - file K5om.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"
      date = "2017-06-07"
      hash1 = "e3494fd2cc7e9e02cff[PII_REDACTED]2e4baed34a3e1ef2b9ae4e2608f9a4d7be9"
      id = "9354d20a-d798-55bf-a735-820f21d4a861"
   strings:
      $x1 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
      $x2 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
      $x3 = "%d is an x86 process (can't inject x64 content)" fullword ascii

      $s1 = "Could not open process token: %d (%u)" fullword ascii
      $s2 = "0fd00b.dll" fullword ascii
      $s3 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" fullword ascii
      $s4 = "Could not connect to pipe (%s): %d" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 600KB and ( 1 of ($x*) or 3 of them ) )
}
YARA Detection Rule: FE_LEGALSTRIKE_MACRO
Repository: Neo23x0/signature-base
Detects: This rule is designed to identify macros with the specific encoding used in the sample 30f149479c02b741e897cdb9ecd22da7.
Author: Ian.Ahl@fireeye.com @TekDefense - modified by Florian Roth

Pattern signatures:
// OBSFUCATION
      $ob1 = "ChrW(114) & ChrW(101) & ChrW(103) & ChrW(115) & ChrW(118) & ChrW(114) & ChrW(51) & ChrW(50) & ChrW(46) & ChrW(101)" ascii wide
      // wscript
      $wsobj1 = "Set Obj = CreateObject(\"WScript.Shell\")" ascii wide
      $wsobj2 = "Obj.Run " ascii wide

Detection condition:
all of them

Full rule:
rule FE_LEGALSTRIKE_MACRO {
   meta:
      version=".1"
      filetype="MACRO"
      author="Ian.Ahl@fireeye.com @TekDefense - modified by Florian Roth"
      date="2017-06-02"
      description="This rule is designed to identify macros with the specific encoding used in the sample 30f149479c02b741e897cdb9ecd22da7."
      id = "eb15e5aa-16e5-5c07-a293-ad15c0c09d8e"
   strings:
      // OBSFUCATION
      $ob1 = "ChrW(114) & ChrW(101) & ChrW(103) & ChrW(115) & ChrW(118) & ChrW(114) & ChrW(51) & ChrW(50) & ChrW(46) & ChrW(101)" ascii wide
      // wscript
      $wsobj1 = "Set Obj = CreateObject(\"WScript.Shell\")" ascii wide
      $wsobj2 = "Obj.Run " ascii wide
   condition:
      all of them
}
YARA Detection Rule: FE_LEGALSTRIKE_RTF
Repository: Neo23x0/signature-base
Detects: Rtf Phishing Campaign leveraging the CVE 2017-0199 exploit, to point to the domain 2bunnyDOTcom
Author: joshua.kim@FireEye. - modified by Florian Roth

Pattern signatures:
$lnkinfo = "4c0069006e006b0049006e0066006f"
      $encoded1 = "4f4c45324c696e6b"
      $encoded2 = "52006f006f[PII_REDACTED]45006e[PII_REDACTED]79"
      $encoded3 = "4f0062006a0049006e0066006f"
      $encoded4 = "4f006c0065"
      $datastore = "\\*\\datastore"

Detection condition:
uint32be(0) == 0x7B5C7274 and all of them

Full rule:
rule FE_LEGALSTRIKE_RTF {
   meta:
      version=".1"
      filetype="MACRO"
      author="joshua.kim@FireEye. - modified by Florian Roth"
      date="2017-06-02"
      description="Rtf Phishing Campaign leveraging the CVE 2017-0199 exploit, to point to the domain 2bunnyDOTcom"
      id = "b62ceffa-445f-517e-b86b-56e47876c6c0"
   strings:
      $lnkinfo = "4c0069006e006b0049006e0066006f"
      $encoded1 = "4f4c45324c696e6b"
      $encoded2 = "52006f006f[PII_REDACTED]45006e[PII_REDACTED]79"
      $encoded3 = "4f0062006a0049006e0066006f"
      $encoded4 = "4f006c0065"
      $datastore = "\\*\\datastore"
   condition:
      uint32be(0) == 0x7B5C7274 and all of them
}
YARA Detection Rule: gen_Excel_xll_addin_suspicious
Repository: Neo23x0/signature-base
Detects: Detects suspicious XLL add-ins to Excel
Author: @JohnLaTwC

Pattern signatures:
$s1 = "CryptStringToBinaryA"
        $s2 = "NtQueueApcThread"
        
        $cs1 = "dsrole.dll"
        $cs2 = "user32.dll"

        $debug = "SeDebugPrivilege"

Detection condition:
filesize < 1MB
        and uint16(0) == 0x5a4d 
        and pe.characteristics & pe.DLL
        and pe.exports("xlAutoOpen")
        and (
              ((pe.imports("KERNEL32.dll", "LookupPrivilegeValueW") or pe.imports("KERNEL32.dll", "LookupPrivilegeValueA"))
                and pe.imports("KERNE

Full rule:
rule gen_Excel_xll_addin_suspicious
{
    meta:
        description = "Detects suspicious XLL add-ins to Excel"
        license = "https://creativecommons.org/licenses/by-nc/4.0/"
        author = "@JohnLaTwC"
        date = "2020-10-16"
        reference1="https://twitter.com/JohnLaTwC/status/[PII_REDACTED]55352326"
        reference2="https://labs.f-secure.com/archive/add-in-opportunities-for-office-persistence/"
        reference3="https://gist.github.com/ryhanson/227229866af52e2d963cf941af135a52"

        hash1="0bad4e4bc5093dcfc2737c4d8be89d6f093509a7b91a1e022050cb890d90e4e0"
        hash2="133e47eedfede46d1a4529ce7f047e09521ed8c7cad2e49d[PII_REDACTED]bd6c43"
        hash3="1994a39d5639b4eea5c3cdf084a8eacf8610a96702e580d88a6ec18887d0ec6b"
        hash4="28f45d01e397841fcba48da1e61e4927f42ff6fe6f32595c23cf9a953cd2658a"
        hash5="54c3598cf22ad64faeb4e0f9f70e026a1ae834a8c06e5187bf289bb3ee43a8ec"
        hash6="5644a04513744edfb247d0ea83e3e2f7d616d6752cfd1af50e866bb0270131ee"
        hash7="836c0d21fc3ea3a8ce1a493097a5034d110e5c50bfd7e6c3dcb674dc7a6a19ec"
        hash8="b926f7db36bc5bae73091c783b0715d2af051de22a579548adf2498cb1a1d075"
        hash9="6ba100a5da5efea14a5ca929628b732a6e6b8ab8f78167db35343e895997ce52"
        hasha="ee603cbd[PII_REDACTED]ae5d8adcf029d5cde710fc966b2b7a2c95249d3b23d693"
        hashb="99195679e998407fd4d606a0d956bda99f79625b638c63f90d9d399c6f2a143e"
        hashc="99534c[PII_REDACTED]ae39967fe5fc6bf526cb2ba5d3b2e99dc7bd03833e4a94ae"
        id = "013db759-ab9d-5505-933b-bda702a0941e"
    strings:
        $s1 = "CryptStringToBinaryA"
        $s2 = "NtQueueApcThread"
        
        $cs1 = "dsrole.dll"
        $cs2 = "user32.dll"

        $debug = "SeDebugPrivilege"
    condition:
        filesize < 1MB
        and uint16(0) == 0x5a4d 
        and pe.characteristics & pe.DLL
        and pe.exports("xlAutoOpen")
        and (
              ((pe.imports("KERNEL32.dll", "LookupPrivilegeValueW") or pe.imports("KERNEL32.dll", "LookupPrivilegeValueA"))
YARA Detection Rule: Gazer_certificate_subject
Repository: Neo23x0/signature-base
Detects: Detects Tura's Gazer malware
Author: ESET
Reference: https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/

Detection condition:
for any i in (0..pe.number_of_signatures - 1):
         (
            pe.signatures[i].subject contains "Solid Loop" or
            pe.signatures[i].subject contains "Ultimate Computer Support"
         )

Full rule:
rule Gazer_certificate_subject {
   meta:
      description = "Detects Tura's Gazer malware"
      author = "ESET"
      reference = "https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/"
      date = "30.08.2017"
      id = "4eace653-003e-5cae-9db8-f26502f35fc4"
   condition:
      for any i in (0..pe.number_of_signatures - 1):
         (
            pe.signatures[i].subject contains "Solid Loop" or
            pe.signatures[i].subject contains "Ultimate Computer Support"
         )
}
YARA Detection Rule: Gazer_certificate
Repository: Neo23x0/signature-base
Detects: Detects Tura's Gazer malware
Author: ESET
Reference: https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/

Pattern signatures:
$certif1 = { 52 76 a4 53 cd 70 9c 18 da 65 15 7e 5f 1f de 02 }
      $certif2 = { 12 90 f2 41 d9 b2 80 af 77 fc da 12 c6 b4 96 9c }

Detection condition:
uint16(0) == 0x5a4d and 1 of them and filesize < 2MB

Full rule:
rule Gazer_certificate {
   meta:
      description = "Detects Tura's Gazer malware"
      author = "ESET"
      reference = "https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/"
      date = "30.08.2017"
      id = "4eace653-003e-5cae-9db8-f26502f35fc4"
   strings:
      $certif1 = { 52 76 a4 53 cd 70 9c 18 da 65 15 7e 5f 1f de 02 }
      $certif2 = { 12 90 f2 41 d9 b2 80 af 77 fc da 12 c6 b4 96 9c }
   condition:
      uint16(0) == 0x5a4d and 1 of them and filesize < 2MB
}
YARA Detection Rule: Gazer_logfile_name
Repository: Neo23x0/signature-base
Detects: Detects Tura's Gazer malware
Author: ESET
Reference: https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/

Pattern signatures:
$s1 = "CVRG72B5.tmp.cvr"
      $s2 = "CVRG1A6B.tmp.cvr"
      $s3 = "CVRG38D9.tmp.cvr"

Detection condition:
uint16(0) == 0x5a4d and 1 of them

Full rule:
rule Gazer_logfile_name {
   meta:
      description = "Detects Tura's Gazer malware"
      author = "ESET"
      reference = "https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/"
      date = "30.08.2017"
      id = "c10d440f-dc9e-54c8-b329-9f22cba05e86"
   strings:
      $s1 = "CVRG72B5.tmp.cvr"
      $s2 = "CVRG1A6B.tmp.cvr"
      $s3 = "CVRG38D9.tmp.cvr"
   condition:
      uint16(0) == 0x5a4d and 1 of them
}
YARA Detection Rule: MAL_Gopuram_Apr23
Repository: Neo23x0/signature-base
Detects: Detects Lazarus Gopuram malware
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/

Pattern signatures:
// VTgrep content:"%s.TxR.0.regtrans-ms" hits only the 2 hashes above
        $path = "%s.TxR.0.regtrans-ms"

Detection condition:
uint16(0) == 0x5A4D and $path and filesize < 10MB

Full rule:
rule MAL_Gopuram_Apr23 {
    meta:
        description = "Detects Lazarus Gopuram malware"
        reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
        license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-04-04"
        hash = "beb775af5196f30e0ee021790a4978ca7a7ac2a7cf970a5a620ffeb89cc60b2c"
        hash = "97b95b4a5461f950e712b82783930cb2a152ec0288c00a977983ca7788342df7"
        id = "e0bb43b0-542b-5c8e-bcba-0326f80efaa0"
    strings:
        // VTgrep content:"%s.TxR.0.regtrans-ms" hits only the 2 hashes above
        $path = "%s.TxR.0.regtrans-ms"
    condition:
        uint16(0) == 0x5A4D and $path and filesize < 10MB
}