deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: MAL_Grace_Dec22
Repository: Neo23x0/signature-base
Detects: Detects Grace (aka FlawedGrace and GraceWire) RAT
Author: X__Junior
Reference: https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/

Pattern signatures:
$sa1 = "Grace finalized, no more library calls allowed." ascii
      $sa2 = "Socket forcibly closed due to no response to DISCONNECT signal from other side, worker id(%d)" ascii
      $sa3 = "AVWireCleanupThread" ascii
      $sa4 = "AVTunnelClientDirectIO" ascii
      $sa5 = "AVGraceTunnelWriteThread" ascii
      $sa6 = "AVGraceTunnelClientDirectIO" ascii

Detection condition:
2 of them

Full rule:
rule MAL_Grace_Dec22 {
    meta:
      author = "X__Junior"
      reference = "https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/"
      description = "Detects Grace (aka FlawedGrace and GraceWire) RAT"
      date = "2022-12-13"
      hash1 = "a66df3454b8c13f1b92d8b2cf74f5bfcdedfbff41a5e4add62e15277d14dd169"
      hash2 = "e113a8df3c4845365f924bacf10c00bcc5e17587a204b640852dafca6db20404"
      score = 70
      id = "fc2214dc-f1e5-52d7-a9de-88709a03b04e"
    strings:
      $sa1 = "Grace finalized, no more library calls allowed." ascii
      $sa2 = "Socket forcibly closed due to no response to DISCONNECT signal from other side, worker id(%d)" ascii
      $sa3 = "AVWireCleanupThread" ascii
      $sa4 = "AVTunnelClientDirectIO" ascii
      $sa5 = "AVGraceTunnelWriteThread" ascii
      $sa6 = "AVGraceTunnelClientDirectIO" ascii
    condition:
      2 of them
}
YARA Detection Rule: MuddyWater_Mal_Doc_Feb18_1
Repository: Neo23x0/signature-base
Detects: Detects malicious document used by MuddyWater
Author: Florian Roth (Nextron Systems)
Reference: Internal Research - TI2T

Pattern signatures:
/* iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( */
      $x1 = "aWV4KFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVuaWNvZGUuR2V0U3RyaW5nKFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmco" ascii
      /* Double Base64 encoded : Invoke-Expression */
      $x2 = "U1FCdUFIWUFid0JyQUdVQUxRQkZBSGdBY0FCeUFHVUFjd0J6QUdrQWJ3QnVBQ0FBS"

Detection condition:
uint16(0) == 0xcfd0 and filesize < 3000KB and 1 of them

Full rule:
rule MuddyWater_Mal_Doc_Feb18_1 {
   meta:
      description = "Detects malicious document used by MuddyWater"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research - TI2T"
      date = "2018-02-26"
      hash1 = "3d96811de7419a8c090a671d001a85f2b1875243e5b38e6f927d9877d0ff9b0c"
      id = "5f275ee8-c6a9-532b-bc82-b109195171da"
   strings:
      /* iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( */
      $x1 = "aWV4KFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVuaWNvZGUuR2V0U3RyaW5nKFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmco" ascii
      /* Double Base64 encoded : Invoke-Expression */
      $x2 = "U1FCdUFIWUFid0JyQUdVQUxRQkZBSGdBY0FCeUFHVUFjd0J6QUdrQWJ3QnVBQ0FBS"
   condition:
      uint16(0) == 0xcfd0 and filesize < 3000KB and 1 of them
}
YARA Detection Rule: MuddyWater_Mal_Doc_Feb18_2
Repository: Neo23x0/signature-base
Detects: Detects malicious document used by MuddyWater
Author: Florian Roth (Nextron Systems)
Reference: Internal Research - TI2T

Pattern signatures:
$s1 = "*\\G{[PII_REDACTED]-C[PII_REDACTED]00046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation" fullword wide
      $s2 = "*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft " wide
      $s3 = "*\\G{[PII_REDACTED]-C[PII_REDACTED]00046}#8.7#0#C:\\Program Files\\Microsoft Office\\Office16\\MSWORD.OLB#Microsoft Word 16.0 O" wide
      $s4 = "scripting.filesystemobject$" fullword ascii
      $s5 = "ID=\"{[PII_REDACTED]-[PII_REDACTED]}\"" fullword ascii

Detection condition:
uint16(0) == 0xcfd0 and filesize < 6000KB and all of them

Full rule:
rule MuddyWater_Mal_Doc_Feb18_2 {
   meta:
      description = "Detects malicious document used by MuddyWater"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research - TI2T"
      date = "2018-02-26"
      hash1 = "3d96811de7419a8c090a671d001a85f2b1875243e5b38e6f927d9877d0ff9b0c"
      hash2 = "366d8b84a43a528e6aaf9ecfc38980b148f[PII_REDACTED]14471ccf011b9bb0832"
      id = "117e1d33-63a3-52c8-acf6-bc61959193db"
   strings:
      $s1 = "*\\G{[PII_REDACTED]-C[PII_REDACTED]00046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation" fullword wide
      $s2 = "*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft " wide
      $s3 = "*\\G{[PII_REDACTED]-C[PII_REDACTED]00046}#8.7#0#C:\\Program Files\\Microsoft Office\\Office16\\MSWORD.OLB#Microsoft Word 16.0 O" wide
      $s4 = "scripting.filesystemobject$" fullword ascii
      $s5 = "ID=\"{[PII_REDACTED]-[PII_REDACTED]}\"" fullword ascii
   condition:
      uint16(0) == 0xcfd0 and filesize < 6000KB and all of them
}
YARA Detection Rule: MAL_MuddyWater_DroppedTask_Jun18_1
Repository: Neo23x0/signature-base
Detects: Detects a dropped Windows task as used by MudyWater in June 2018
Author: Florian Roth (Nextron Systems)
Reference: https://app.any.run/tasks/719c94eb-0a00-47cc-b583-ad4f9e25ebdb

Pattern signatures:
$x1 = "%11%\\scrobj.dll,NI,c:" wide

      $s1 = "AppAct = \"SOFTWARE\\Microsoft\\Connection Manager\"" fullword wide
      $s2 = "[DefenderService]" fullword wide
      $s3 = "UnRegisterOCXs=EventManager" fullword wide
      $s4 = "ShortSvcName=\" \"" fullword wide

Detection condition:
uint16(0) == 0xfeff and filesize < 1KB and ( 1 of ($x*) or 3 of them )

Full rule:
rule MAL_MuddyWater_DroppedTask_Jun18_1 {
   meta:
      description = "Detects a dropped Windows task as used by MudyWater in June 2018"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://app.any.run/tasks/719c94eb-0a00-47cc-b583-ad4f9e25ebdb"
      date = "2018-06-12"
      hash1 = "7ecc2e1817f655ece2bde39b7d6633f4f586093047ec5697a1fab6adc7e1da54"
      id = "d9ef379d-161f-59f1-873e-3af12b24b76b"
   strings:
      $x1 = "%11%\\scrobj.dll,NI,c:" wide

      $s1 = "AppAct = \"SOFTWARE\\Microsoft\\Connection Manager\"" fullword wide
      $s2 = "[DefenderService]" fullword wide
      $s3 = "UnRegisterOCXs=EventManager" fullword wide
      $s4 = "ShortSvcName=\" \"" fullword wide
   condition:
      uint16(0) == 0xfeff and filesize < 1KB and ( 1 of ($x*) or 3 of them )
}
YARA Detection Rule: SUSP_DeviceGuard_WDS_Evasion
Repository: Neo23x0/signature-base
Detects: Detects WDS file used to circumvent Device Guard
Author: Florian Roth (Nextron Systems)
Reference: http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html

Pattern signatures:
$s1 = "r @$ip=@$t0" ascii
      $s2 = ";eb @$t0+" ascii
      $s3 = ".foreach /pS" ascii

Detection condition:
filesize < 50KB and all of them

Full rule:
rule SUSP_DeviceGuard_WDS_Evasion {
   meta:
      author = "Florian Roth (Nextron Systems)"
      description = "Detects WDS file used to circumvent Device Guard"
      score = 70
      date = "2015-01-01"
      modified = "2023-01-06"
      reference = "http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html"
      id = "469b60d4-43d3-5a85-aa51-e453d8c858c0"
   strings:
      $s1 = "r @$ip=@$t0" ascii
      $s2 = ";eb @$t0+" ascii
      $s3 = ".foreach /pS" ascii
   condition:
      filesize < 50KB and all of them
}
YARA Detection Rule: LNK_Malicious_Nov1
Repository: Neo23x0/signature-base
Detects: Detects a suspicious LNK file
Author: Florian Roth (Nextron Systems)
Reference: https://www.virustotal.com/en/file/ee069edc46a18698fa99b6d2204895e6a516af1a306ea986a798b178f289ecd6/analysis/

Pattern signatures:
$c1 = "C:\\Windows\\System32\\cmd.exe" ascii wide

      $s1 = "cmd.exe /" ascii wide nocase
      $s2 = { 00 25 00 53 00 79 00 73 00 74 00 65 00 6D 00 52
              00 6F 00 6F 00 74 00 25 00 5C 00 53 00 79 00 73
              00 74 00 65 00 6D 00 33 00 32 00 EF 01 2F 00 43
              00 20 00 22 00 63 00 6D 00 64 00 2E 00 65 00 78
              00 65 }
      $s3 = "%comspec%" ascii wide nocase fullword

      $fp1 = "Microsoft Visual" ascii wide

Detection condition:
( uint32(0) == 0x0000004c and filesize < 4KB and $c1 and 1 of ($s*) )
      and not 1 of ($fp*)

Full rule:
rule LNK_Malicious_Nov1 {
   meta:
      description = "Detects a suspicious LNK file"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.virustotal.com/en/file/ee069edc46a18698fa99b6d2204895e6a516af1a306ea986a798b178f289ecd6/analysis/"
      date = "2017-11-06"
      score = 60
      id = "1d08ac78-6ff0-5e3f-acc2-91bd63267d4c"
   strings:
      $c1 = "C:\\Windows\\System32\\cmd.exe" ascii wide

      $s1 = "cmd.exe /" ascii wide nocase
      $s2 = { 00 25 00 53 00 79 00 73 00 74 00 65 00 6D 00 52
              00 6F 00 6F 00 74 00 25 00 5C 00 53 00 79 00 73
              00 74 00 65 00 6D 00 33 00 32 00 EF 01 2F 00 43
              00 20 00 22 00 63 00 6D 00 64 00 2E 00 65 00 78
              00 65 }
      $s3 = "%comspec%" ascii wide nocase fullword

      $fp1 = "Microsoft Visual" ascii wide
   condition:
      ( uint32(0) == 0x0000004c and filesize < 4KB and $c1 and 1 of ($s*) )
      and not 1 of ($fp*)
}
YARA Detection Rule: MAL_RANSOM_Stealbit_Aug21
Repository: Neo23x0/signature-base
Detects: Detects Stealbit used by Lockbit 2.0 Ransomware Gang
Author: Frank Boldewin (@r3c0nst)
Reference: https://raw.githubusercontent.com/fboldewin/YARA-rules/master/Lockbit2.Stealbit.yar

Pattern signatures:
$C2Decryption = {33 C9 8B C1 83 E0 0F 8A 80 ?? ?? ?? ?? 30 81 ?? ?? ?? ?? 41 83 F9 7C 72 E9 E8}

Detection condition:
uint16(0) == 0x5A4D and filesize < 100KB and $C2Decryption

Full rule:
rule MAL_RANSOM_Stealbit_Aug21 {
	meta:
		description = "Detects Stealbit used by Lockbit 2.0 Ransomware Gang"
		author = "Frank Boldewin (@r3c0nst)"
		reference = "https://raw.githubusercontent.com/fboldewin/YARA-rules/master/Lockbit2.Stealbit.yar"
		date = "2021-08-12"
		hash1 = "3407f26b3d69f1dfce76782fee1256274cf92f744c65aa1ff2d3eaaaf61b0b1d"
		hash2 = "bd14872dd9fdead89fc074fdc5832caea4ceac02983ec41f814278130b3f943e"
		id = "07b466cb-92b3-51f2-a702-2930bb7038c6"
	strings:
		$C2Decryption = {33 C9 8B C1 83 E0 0F 8A 80 ?? ?? ?? ?? 30 81 ?? ?? ?? ?? 41 83 F9 7C 72 E9 E8}
	condition:
		uint16(0) == 0x5A4D and filesize < 100KB and $C2Decryption
}
YARA Detection Rule: MAL_JS_NPM_SupplyChain_Attack_Nov25
Repository: Neo23x0/signature-base
Detects: Detects malicious JavaScript worm bun_environment.js
Author: Marius Benthin
Reference: https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains

Pattern signatures:
$sa1 = "npm publish"
      $sa2 = "NPM_TOKEN"
      $sa3 = "NPM_CONFIG_TOKEN"

      $sb1 = "GITHUB_"
      $sb2 = "GITLAB_"
      $sb3 = "TEAMCITY_"

Detection condition:
filesize < 20MB
      and all of ($sa*)
      and 2 of ($sb*)

Full rule:
rule MAL_JS_NPM_SupplyChain_Attack_Nov25 {
   meta:
      description = "Detects malicious JavaScript worm bun_environment.js"
      author = "Marius Benthin"
      date = "2025-11-24"
      modified = "2025-12-15"
      reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
      hash = "62ee164b9b306250c1172583f138c[PII_REDACTED]f889fa99614903c12755468d0"
      score = 80
   strings:
      $sa1 = "npm publish"
      $sa2 = "NPM_TOKEN"
      $sa3 = "NPM_CONFIG_TOKEN"

      $sb1 = "GITHUB_"
      $sb2 = "GITLAB_"
      $sb3 = "TEAMCITY_"
   condition:
      filesize < 20MB
      and all of ($sa*)
      and 2 of ($sb*)
}
YARA Detection Rule: SUSP_JS_NPM_Sha1_Hulud_Nov25
Repository: Neo23x0/signature-base
Detects: Detects suspicious indicators for Sha1 Hulud worm
Author: Marius Benthin
Reference: https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains

Pattern signatures:
$x1 = "Sha1-Hulud:\\x"
      $x2 = "SHA1HULUD\"`"

Detection condition:
filesize < 20MB
      and 1 of them

Full rule:
rule SUSP_JS_NPM_Sha1_Hulud_Nov25 {
   meta:
      description = "Detects suspicious indicators for Sha1 Hulud worm"
      author = "Marius Benthin"
      date = "2025-11-24"
      modified = "2025-12-15"
      reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
      hash = "62ee164b9b306250c1172583f138c[PII_REDACTED]f889fa99614903c12755468d0"
      score = 70
   strings:
      $x1 = "Sha1-Hulud:\\x"
      $x2 = "SHA1HULUD\"`"
   condition:
      filesize < 20MB
      and 1 of them
}
YARA Detection Rule: SUSP_JS_NPM_SetupScript_Nov25
Repository: Neo23x0/signature-base
Detects: Detects suspicious JavaScript which exits silently and checks operating system
Author: Marius Benthin
Reference: https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains

Pattern signatures:
$sa1 = "require('child_process')"
      $sa2 = "process.platform ==="

      $sb1 = "().catch((e"
      $sb2 = "process.exit(0)"

Detection condition:
filesize < 100KB
      and all of ($sa*)
      and $sb1 in (filesize - 50..filesize)
      and $sb2 in (filesize - 30..filesize)

Full rule:
rule SUSP_JS_NPM_SetupScript_Nov25 {
   meta:
      description = "Detects suspicious JavaScript which exits silently and checks operating system"
      author = "Marius Benthin"
      date = "2025-11-24"
      modified = "2025-12-15"
      reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
      hash = "a3894003ad1d293ba96d77881ccd2071446dc3f65f434669b49b3da92421901a"
      score = 70
   strings:
      $sa1 = "require('child_process')"
      $sa2 = "process.platform ==="

      $sb1 = "().catch((e"
      $sb2 = "process.exit(0)"
   condition:
      filesize < 100KB
      and all of ($sa*)
      and $sb1 in (filesize - 50..filesize)
      and $sb2 in (filesize - 30..filesize)
}
YARA Detection Rule: MAL_NPM_SupplyChain_Attack_PreInstallScript_Nov25
Repository: Neo23x0/signature-base
Detects: Detects known malicious preinstall script in package.json
Author: Marius Benthin
Reference: https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains

Pattern signatures:
$x1 = "\"preinstall\": \"node setup_bun.js\""

Detection condition:
filesize < 10KB
      and all of them

Full rule:
rule MAL_NPM_SupplyChain_Attack_PreInstallScript_Nov25 {
   meta:
      description = "Detects known malicious preinstall script in package.json"
      author = "Marius Benthin"
      date = "2025-11-24"
      reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
      hash = "c4bc2afd133916f064f2fb7d1e2e067ea65db33463eeae2fa54a9860a6303865"
      score = 80
   strings:
      $x1 = "\"preinstall\": \"node setup_bun.js\""
   condition:
      filesize < 10KB
      and all of them
}
YARA Detection Rule: SUSP_XORed_URL_In_EXE
Repository: Neo23x0/signature-base
Detects: Detects an XORed URL in an executable
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/stvemillertime/status/[PII_REDACTED]73560834

Pattern signatures:
$s1 = "http://" xor
      $s2 = "https://" xor
      $f1 = "http://" ascii
      $f2 = "https://" ascii

      $fp01 = "3Com Corporation" ascii  /* old driver */
      $fp02 = "bootloader.jar" ascii  /* DeepGit */
      $fp03 = "AVAST Software" ascii wide
      $fp04 = "smartsvn" wide ascii fullword
      $fp05 = "Avira Operations GmbH" wide fullword
      $fp06 = "Perl Dev Kit" wide fullword
      $fp07 = "Digiread" wide fullword
      $fp08 = "Avid Editor" wide fullword
      $fp09 = "Digisign" wide fullword
      $fp10 = "Microsoft Corporation" wide fullword
      $fp11 = "Microsoft Code Signing" ascii wide
      $fp12 = "XtraProxy" wide fullword
      $fp13 = "A Sophos Company" wide
      $fp14 = "http://crl3.digicert.com/" ascii
      $fp15 = "http://crl.sectigo.com/SectigoRSACodeSigningCA.crl" ascii
      $fp16 = "HitmanPro.Alert" wide fullword

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 2000KB and (
         ( $s1 and #s1 > #f1 ) or
         ( $s2 and #s2 > #f2 )
      )
      and not 1 of ($fp*)
      and not pe.number_of_signatures > 0

Full rule:
rule SUSP_XORed_URL_In_EXE {
   meta:
      description = "Detects an XORed URL in an executable"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/stvemillertime/status/[PII_REDACTED]73560834"
      date = "2020-03-09"
      modified = "2022-09-16"
      score = 50
      id = "f83991c8-f2d9-5583-845a-d105034783ab"
   strings:
      $s1 = "http://" xor
      $s2 = "https://" xor
      $f1 = "http://" ascii
      $f2 = "https://" ascii

      $fp01 = "3Com Corporation" ascii  /* old driver */
      $fp02 = "bootloader.jar" ascii  /* DeepGit */
      $fp03 = "AVAST Software" ascii wide
      $fp04 = "smartsvn" wide ascii fullword
      $fp05 = "Avira Operations GmbH" wide fullword
      $fp06 = "Perl Dev Kit" wide fullword
      $fp07 = "Digiread" wide fullword
      $fp08 = "Avid Editor" wide fullword
      $fp09 = "Digisign" wide fullword
      $fp10 = "Microsoft Corporation" wide fullword
      $fp11 = "Microsoft Code Signing" ascii wide
      $fp12 = "XtraProxy" wide fullword
      $fp13 = "A Sophos Company" wide
      $fp14 = "http://crl3.digicert.com/" ascii
      $fp15 = "http://crl.sectigo.com/SectigoRSACodeSigningCA.crl" ascii
      $fp16 = "HitmanPro.Alert" wide fullword
   condition:
      uint16(0) == 0x5a4d and
      filesize < 2000KB and (
         ( $s1 and #s1 > #f1 ) or
         ( $s2 and #s2 > #f2 )
      )
      and not 1 of ($fp*)
      and not pe.number_of_signatures > 0
}
YARA Detection Rule: Metasploit_Loader_RSMudge
Repository: Neo23x0/signature-base
Detects: Detects a Metasploit Loader by RSMudge - file loader.exe
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/rsmudge/metasploit-loader

Pattern signatures:
$s1 = "Could not resolve target" fullword ascii
		$s2 = "Could not connect to target" fullword ascii
		$s3 = "%s [host] [port]" fullword ascii
		$s4 = "ws2_32.dll is out of date." fullword ascii
		$s5 = "read a strange or incomplete length value" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and ( 3 of ($s*) ) ) or ( all of them )

Full rule:
rule Metasploit_Loader_RSMudge {
	meta:
		description = "Detects a Metasploit Loader by RSMudge - file loader.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/rsmudge/metasploit-loader"
		date = "2016-04-20"
		hash1 = "afe34bfe2215b048915b1d55324f1679d598a0741123bc24274d4edc6e395a8d"
		id = "4d8a215e-a942-5df9-bdad-0c[PII_REDACTED]"
	strings:
		$s1 = "Could not resolve target" fullword ascii
		$s2 = "Could not connect to target" fullword ascii
		$s3 = "%s [host] [port]" fullword ascii
		$s4 = "ws2_32.dll is out of date." fullword ascii
		$s5 = "read a strange or incomplete length value" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 200KB and ( 3 of ($s*) ) ) or ( all of them )
}
YARA Detection Rule: Octowave_Loader_Supporting_File_03_2025
Repository: Neo23x0/signature-base
Detects: Detects supporting file used by Octowave loader containing hardcoded values
Author: Jai Minton (@CyberRaiju) - HuntressLabs
Reference: https://x.com/CyberRaiju/status/[PII_REDACTED]24362946?t=u0X6ST2Qgnrf-ujjphGOSg&s=19

Pattern signatures:
$unique_key = {1D 1C 1F 1E 01 01 03 02 05 04 07 06 09 D4 0E 0A 0D 0C 0F 0E 31 30 31 32 35 34 36 36 39 38 DC 3F 3D 3C 3E} //[PII_REDACTED] unknown unique identifier and surrounding bytes
        $unique_string = "MLONqpsrutwvyx"
        $unique_string2 = "A@CBEDGFIHKJMLONqpsrutwvyx"

Detection condition:
uint16(0) != 0x5a4d
        and filesize < 10000KB
        and all of them

Full rule:
rule Octowave_Loader_Supporting_File_03_2025
{
    meta:
        description = "Detects supporting file used by Octowave loader containing hardcoded values"
        author = "Jai Minton (@CyberRaiju) - HuntressLabs"
        date = "2025-03-19"
		  score = 75
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        yt_reference = "https://www.youtube.com/watch?v=NiNIbkiuExU"
        reference = "https://x.com/CyberRaiju/status/[PII_REDACTED]24362946?t=u0X6ST2Qgnrf-ujjphGOSg&s=19"
        hash1 = "C4CBAA7E4521FA0ED9CC634C5E2BACBF41F46842CA4526B7904D98843A7E9DB9"
        hash2 = "F5CFB2E634539D5DC7FFE202FFDC422EF[PII_REDACTED]BA1FBC21DD[PII_REDACTED]5"
        hash3 = "56F1967F7177C166386D864807CDF03D5BBD3F118A285CE67EA226D02E5CF58C"
        hash4 = "11EE5AD8A81AE85E5B7DDF93ADF6EDD20DE8460C755BF0426DFCBC7F658D7E85"
        hash5 = "D218B65493E4D9D85CBC2F7B608F4F7E501708014BC04AF27D33D995AA54A703"
        hash6 = "0C112F9DFE27211B357C74F358D9C144EA10CC0D92D6420B8742B72A65562C5A"
        id = "2c81c8b8-4b4d-55c9-9285-556e8b5303bd"
    strings:
        $unique_key = {1D 1C 1F 1E 01 01 03 02 05 04 07 06 09 D4 0E 0A 0D 0C 0F 0E 31 30 31 32 35 34 36 36 39 38 DC 3F 3D 3C 3E} //[PII_REDACTED] unknown unique identifier and surrounding bytes
        $unique_string = "MLONqpsrutwvyx"
        $unique_string2 = "A@CBEDGFIHKJMLONqpsrutwvyx"
    condition:
        uint16(0) != 0x5a4d
        and filesize < 10000KB
        and all of them
}
YARA Detection Rule: Methodology_Suspicious_Shortcut_Local_URL
Repository: Neo23x0/signature-base
Detects: Detects local script usage for .URL persistence
Author: @itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson)
Reference: https://twitter.com/cglyer/status/[PII_REDACTED]48919044

Pattern signatures:
$file = "URL=file:///" nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase

Detection condition:
$file and any of ($url*)
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB

Full rule:
rule Methodology_Suspicious_Shortcut_Local_URL
{
  meta:
    author = "@itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson)"
    description = "Detects local script usage for .URL persistence"
    reference = "https://twitter.com/cglyer/status/[PII_REDACTED]48919044"
    score = 50
    date = "27.09.2019"
    id = "438d9323-cb6a-5f5d-af71-76692b93436a"
  strings:
    $file = "URL=file:///" nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase
  condition:
    $file and any of ($url*)
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB
}