deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: WEBSHELL_ASPX_Compiled_Sharepoint_Drop_CVE_2025_53770_Jul25_2
Repository: Neo23x0/signature-base
Detects: Detects compiled ASPX web shell dropped during the exploitation of SharePoint RCE vulnerability CVE-2025-53770
Author: Florian Roth, Marius Benthin
Reference: https://research.eye.security/sharepoint-under-siege/

Pattern signatures:
$x1 = /App_Web_spinstall\d{0,1}.aspx/ wide
      $x2 = /spinstall[\w]?[\._]aspx/ ascii
      $x3 = /\/_layouts\/1[0-9]\/spinstall/ wide
      $x4 = /\/_layouts\/1[0-9]\/ghostfile/ wide

      $s1 = "System.Web.Configuration.MachineKeySection" wide
      $s2 = "Page_load" ascii fullword
      $s3 = "GetApplicationConfig" wide fullword

Detection condition:
uint16(0) == 0x5a4d
      and filesize < 20KB
      and (
         1 of ($x*)
         or all of ($s*)
      )
      or 2 of ($x*)
      or 4 of them

Full rule:
rule WEBSHELL_ASPX_Compiled_Sharepoint_Drop_CVE_2025_53770_Jul25_2 {
   meta:
      description = "Detects compiled ASPX web shell dropped during the exploitation of SharePoint RCE vulnerability CVE-2025-53770"
      author = "Florian Roth, Marius Benthin"
      reference = "https://research.eye.security/sharepoint-under-siege/"
      date = "2025-07-20"
      modified = "2025-07-25"
      score = 75
      hash = "8d3d3f3a17d233bc8562765e61f7314ca7a08130ac0fb153ffd091612920b0f2"
      hash = "d8ca5e5d6400ac34ac4cc138efa89d2ec4d5c0e968a78fa3ba5dbc04c7550649"
      hash = "7e9b77da1f51d03ee2f96bc976f6aeb781f801cf633862a4b8c356cbb555927d"
   strings:
      $x1 = /App_Web_spinstall\d{0,1}.aspx/ wide
      $x2 = /spinstall[\w]?[\._]aspx/ ascii
      $x3 = /\/_layouts\/1[0-9]\/spinstall/ wide
      $x4 = /\/_layouts\/1[0-9]\/ghostfile/ wide

      $s1 = "System.Web.Configuration.MachineKeySection" wide
      $s2 = "Page_load" ascii fullword
      $s3 = "GetApplicationConfig" wide fullword
   condition:
      uint16(0) == 0x5a4d
      and filesize < 20KB
      and (
         1 of ($x*)
         or all of ($s*)
      )
      or 2 of ($x*)
      or 4 of them
}
YARA Detection Rule: APT_EXPL_Sharepoint_CVE_2025_53770_ForensicArtefact_Jul25_1
Repository: Neo23x0/signature-base
Detects: Detects URIs accessed during the exploitation of SharePoint RCE vulnerability CVE-2025-53770
Author: Florian Roth
Reference: https://research.eye.security/sharepoint-under-siege/

Pattern signatures:
$sa1 = /POST \/_layouts\/1[0-9]\/ToolPane\.aspx/ ascii wide nocase
      $sa2 = "DisplayMode=Edit&a=/ToolPane.aspx" ascii wide

      $sb1 = /GET \/_layouts\/1[0-9]\/spinstall/ ascii wide  // specific
      $sb2 = "/_layouts/SignOut.aspx 200" ascii wide nocase

Detection condition:
(@sa2 - @sa1) < 700  // unknown how specific with the DisplayMode=Edit parameter
      or (@sb2 - @sb1) < 700  // specific combination
      or (@sb2 - @sa1) < 700  // most generic combination

Full rule:
rule APT_EXPL_Sharepoint_CVE_2025_53770_ForensicArtefact_Jul25_1 {
   meta:
      description = "Detects URIs accessed during the exploitation of SharePoint RCE vulnerability CVE-2025-53770"
      author = "Florian Roth"
      reference = "https://research.eye.security/sharepoint-under-siege/"
      date = "2025-07-20"
      modified = "2025-07-23"
      score = 75
   strings:
      $sa1 = /POST \/_layouts\/1[0-9]\/ToolPane\.aspx/ ascii wide nocase
      $sa2 = "DisplayMode=Edit&a=/ToolPane.aspx" ascii wide

      $sb1 = /GET \/_layouts\/1[0-9]\/spinstall/ ascii wide  // specific
      $sb2 = "/_layouts/SignOut.aspx 200" ascii wide nocase
   condition:
      (@sa2 - @sa1) < 700  // unknown how specific with the DisplayMode=Edit parameter
      or (@sb2 - @sb1) < 700  // specific combination
      or (@sb2 - @sa1) < 700  // most generic combination
}
YARA Detection Rule: Tofu_Backdoor
Repository: Neo23x0/signature-base
Detects: Detects Tofu Trojan
Author: Cylance
Reference: https://www.cylance.com/en_us/blog/the-deception-project-a-new-japanese-centric-threat.html

Pattern signatures:
$a = "Cookies: Sym1.0"
   	$b = "\\\\.\\pipe\\1[12345678]"
   	$c = {66 0F FC C1 0F 11 40 D0 0F 10 40 D0 66 0F EF C2 0F 11 40 D0 0F 10 40 E0}

Detection condition:
$a or $b or $c

Full rule:
rule Tofu_Backdoor {
   meta:
      description = "Detects Tofu Trojan"
      author = "Cylance"
      reference = "https://www.cylance.com/en_us/blog/the-deception-project-a-new-japanese-centric-threat.html"
      date = "2017-02-28"
      id = "03848366-f139-5352-959d-390992d96296"
   strings:
   	$a = "Cookies: Sym1.0"
   	$b = "\\\\.\\pipe\\1[12345678]"
   	$c = {66 0F FC C1 0F 11 40 D0 0F 10 40 D0 66 0F EF C2 0F 11 40 D0 0F 10 40 E0}
   condition:
   	$a or $b or $c
}
YARA Detection Rule: malware_sakula_xorloop
Repository: Neo23x0/signature-base
Detects: XOR loops from Sakula malware
Author: David Cannings

Pattern signatures:
// XOR decode loop (non-null, non-key byte only)
    $opcodes_decode_loop01 = { 31 C0 8A 04 0B 3C 00 74 09 38 D0 74 05 30 D0 88 04 0B }

    // XOR decode
    $opcodes_decode_loop02 = { 8B 45 08 8D 0C 02 8A 01 84 C0 74 08 3C ?? 74 04 34 ?? 88 01 }

Detection condition:
uint16(0) == 0x5A4D and any of ($opcodes*)

Full rule:
rule malware_sakula_xorloop {
  meta:
    description = "XOR loops from Sakula malware"
    author = "David Cannings"
    md5 = "fc6497fe708dbda[PII_REDACTED]b6181e7"
    date = "2016-06-13"
    modified = "2023-01-27"
    id = "9349b7e4-560c-5d8b-94d9-cbb9fd09e132"
  strings:
    // XOR decode loop (non-null, non-key byte only)
    $opcodes_decode_loop01 = { 31 C0 8A 04 0B 3C 00 74 09 38 D0 74 05 30 D0 88 04 0B }

    // XOR decode
    $opcodes_decode_loop02 = { 8B 45 08 8D 0C 02 8A 01 84 C0 74 08 3C ?? 74 04 34 ?? 88 01 }

  condition:
    uint16(0) == 0x5A4D and any of ($opcodes*)
}
YARA Detection Rule: malware_sakula_memory
Repository: Neo23x0/signature-base
Detects: Sakula malware - strings after unpacking (memory rule)
Author: David Cannings

Pattern signatures:
$str01 = "cmd.exe /c ping 127.0.0.1 & del \"%s\""
    $str02 = "cmd.exe /c rundll32 \"%s\" Play \"%s\""
    $str03 = "Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+SV1)"
    $str04 = "cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c \"%s\""
    $str05 = "Self Process Id:%d"
    $str06 = "%d_%d_%d_%s"
    $str07 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)"
    $str08 = "cmd.exe /c rundll32 \"%s\" ActiveQvaw \"%s\""

    // Encode loop, operations: rol 1; xor ??;
    $opcodes01 = { 83 F9 00 74 0E 31 C0 8A 03 D0 C0 34 ?? 88 03 49 43 EB ED }

    // Encode loop, single byte XOR
    $opcodes02 = { 31 C0 8A 04 13 32 01 83 F8 00 75 0E 83 FA 00 74 04 49 4A }

Detection condition:
4 of them

Full rule:
rule malware_sakula_memory {
  meta:
    description = "Sakula malware - strings after unpacking (memory rule)"
    author = "David Cannings"
    md5 = "b3852b9e7f2b8954be447121bb6b65c3"

    id = "328e3707-d11d-5b7f-bec4-18a42a2c658b"
  strings:
    $str01 = "cmd.exe /c ping 127.0.0.1 & del \"%s\""
    $str02 = "cmd.exe /c rundll32 \"%s\" Play \"%s\""
    $str03 = "Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+SV1)"
    $str04 = "cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c \"%s\""
    $str05 = "Self Process Id:%d"
    $str06 = "%d_%d_%d_%s"
    $str07 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)"
    $str08 = "cmd.exe /c rundll32 \"%s\" ActiveQvaw \"%s\""

    // Encode loop, operations: rol 1; xor ??;
    $opcodes01 = { 83 F9 00 74 0E 31 C0 8A 03 D0 C0 34 ?? 88 03 49 43 EB ED }

    // Encode loop, single byte XOR
    $opcodes02 = { 31 C0 8A 04 13 32 01 83 F8 00 75 0E 83 FA 00 74 04 49 4A }

  condition:
    4 of them
}
YARA Detection Rule: malware_sakula_shellcode
Repository: Neo23x0/signature-base
Detects: Sakula shellcode - taken from decoded setup.msi but may not be unique enough to identify Sakula
Author: David Cannings

Pattern signatures:
/*
      55                      push    ebp
      89 E5                   mov     ebp, esp
      E8 00 00 00 00          call    $+5
      58                      pop     eax
      83 C0 06                add     eax, 6
      C9                      leave
      C3                      retn
    */
    // Get EIP technique (may not be unique enough to identify Sakula)
    // Note this only appears in memory or decoded files
    $opcodes01 = { 55 89 E5 E8 00 00 00 00 58 83 C0 06 C9 C3 }

    /*
      8B 5E 3C                mov     ebx, [esi+3Ch]  ; Offset to PE header
      8B 5C 1E 78             mov     ebx, [esi+ebx+78h] ; Length of headers
      8B 4C 1E 20             mov     ecx, [esi+ebx+20h] ; Number of data directories
      53                      push    ebx
      8B 5C 1E 24             mov     ebx, [esi+ebx+24h] ; Export table
      01 F3                   add     ebx, esi
    */
    // Export parser
    $opcodes02 = { 8B 5E 3C 8B 5C 1E 78 8B 4C 1E 20 53 8B 5C 1E 24 01 F3 }

Detection condition:
any of them

Full rule:
rule malware_sakula_shellcode {
  meta:
    description = "Sakula shellcode - taken from decoded setup.msi but may not be unique enough to identify Sakula"
    author = "David Cannings"

    id = "147e4894-7877-5367-9f6b-588eb7f0379a"
  strings:
    /*
      55                      push    ebp
      89 E5                   mov     ebp, esp
      E8 00 00 00 00          call    $+5
      58                      pop     eax
      83 C0 06                add     eax, 6
      C9                      leave
      C3                      retn
    */
    // Get EIP technique (may not be unique enough to identify Sakula)
    // Note this only appears in memory or decoded files
    $opcodes01 = { 55 89 E5 E8 00 00 00 00 58 83 C0 06 C9 C3 }

    /*
      8B 5E 3C                mov     ebx, [esi+3Ch]  ; Offset to PE header
      8B 5C 1E 78             mov     ebx, [esi+ebx+78h] ; Length of headers
      8B 4C 1E 20             mov     ecx, [esi+ebx+20h] ; Number of data directories
      53                      push    ebx
      8B 5C 1E 24             mov     ebx, [esi+ebx+24h] ; Export table
      01 F3                   add     ebx, esi
    */
    // Export parser
    $opcodes02 = { 8B 5E 3C 8B 5C 1E 78 8B 4C 1E 20 53 8B 5C 1E 24 01 F3 }

  condition:
    any of them
}
YARA Detection Rule: SUSP_ENV_Folder_Root_File_Jan23_1
Repository: Neo23x0/signature-base
Detects: Detects suspicious file path pointing to the root of a folder easily accessible via environment variables
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$xr1 = /%([Aa]pp[Dd]ata|APPDATA)%\\[A-Za-z0-9_\-]{1,20}\.[a-zA-Z0-9]{1,4}[^\\]/ wide ascii
      $xr2 = /%([Pp]ublic|PUBLIC)%\\[A-Za-z0-9_\-]{1,20}\.[a-zA-Z0-9]{1,4}[^\\]/ wide ascii
      $xr4 = /%([Pp]rogram[Dd]ata|PROGRAMDATA)%\\[A-Za-z0-9_\-]{1,20}\.[a-zA-Z0-9]{1,4}[^\\]/ wide ascii

      $fp1 = "perl -MCPAN " ascii
      $fp2 = "CCleaner" ascii

Detection condition:
filesize < 20MB and 1 of ($x*)
      and not 1 of ($fp*)
      and not pe.number_of_signatures > 0

Full rule:
rule SUSP_ENV_Folder_Root_File_Jan23_1 : SCRIPT {
   meta:
      description = "Detects suspicious file path pointing to the root of a folder easily accessible via environment variables"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2023-01-11"
      score = 70
      id = "6067d822-5c1b-5b86-863c-fdcfa37da665"
   strings:
      $xr1 = /%([Aa]pp[Dd]ata|APPDATA)%\\[A-Za-z0-9_\-]{1,20}\.[a-zA-Z0-9]{1,4}[^\\]/ wide ascii
      $xr2 = /%([Pp]ublic|PUBLIC)%\\[A-Za-z0-9_\-]{1,20}\.[a-zA-Z0-9]{1,4}[^\\]/ wide ascii
      $xr4 = /%([Pp]rogram[Dd]ata|PROGRAMDATA)%\\[A-Za-z0-9_\-]{1,20}\.[a-zA-Z0-9]{1,4}[^\\]/ wide ascii

      $fp1 = "perl -MCPAN " ascii
      $fp2 = "CCleaner" ascii
   condition:
      filesize < 20MB and 1 of ($x*)
      and not 1 of ($fp*)
      and not pe.number_of_signatures > 0
}
YARA Detection Rule: Triton_trilog
Repository: Neo23x0/signature-base
Detects: Detects Triton APT malware - file trilog.exe
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/vtQoCQ

Pattern signatures:
$s1 = "inject.bin" ascii
      $s2 = "PYTHON27.DLL" fullword ascii
      $s3 = "payload" ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 60KB and all of them

Full rule:
rule Triton_trilog {
   meta:
      description = "Detects Triton APT malware - file trilog.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/vtQoCQ"
      date = "2017-12-14"
      hash1 = "e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230"
      id = "ae2c9b47-2a67-50c6-9d2a-dc47b4fa69ef"
   strings:
      $s1 = "inject.bin" ascii
      $s2 = "PYTHON27.DLL" fullword ascii
      $s3 = "payload" ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 60KB and all of them
}
YARA Detection Rule: turla_png_reg_enum_payload
Repository: Neo23x0/signature-base
Detects: Payload that has most recently been dropped by the Turla PNG Dropper
Author: Ben Humphrey
Reference: https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/november/turla-png-dropper-is-back/

Pattern signatures:
$crypt00 = "Microsoft Software Key Storage Provider" wide
        $crypt01 = "ChainingModeCBC" wide
        /* $crypt02 = "AES" wide */ /* disabled due to performance reasons */

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and
        pe.imports("advapi32.dll", "StartServiceCtrlDispatcherA") and
        pe.imports("advapi32.dll", "RegEnumValueA") and
        pe.imports("advapi32.dll", "RegEnumKeyExA") and
        pe.imports("ncrypt.dll", "NCryptOpenStorageProvid

Full rule:
rule turla_png_reg_enum_payload {
    meta:
        author = "Ben Humphrey"
        description = "Payload that has most recently been dropped by the Turla PNG Dropper"
        reference = "https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/november/turla-png-dropper-is-back/"
        date = "2018/11/23"
        hash1 = "fea27eb2e939e930c8617dcf64366d1649988f30555f6ee9cd09fe54e4bc22b3"
        id = "413bb315-3c01-56ab-92db-00342a11438a"
    strings:
        $crypt00 = "Microsoft Software Key Storage Provider" wide
        $crypt01 = "ChainingModeCBC" wide
        /* $crypt02 = "AES" wide */ /* disabled due to performance reasons */
    condition:
        (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and
        pe.imports("advapi32.dll", "StartServiceCtrlDispatcherA") and
        pe.imports("advapi32.dll", "RegEnumValueA") and
        pe.imports("advapi32.dll", "RegEnumKeyExA") and
        pe.imports("ncrypt.dll", "NCryptOpenStorageProvider") and
        pe.imports("ncrypt.dll", "NCryptEnumKeys") and
        pe.imports("ncrypt.dll", "NCryptOpenKey") and
        pe.imports("ncrypt.dll", "NCryptDecrypt") and
        pe.imports("ncrypt.dll", "BCryptGenerateSymmetricKey") and
        pe.imports("ncrypt.dll", "BCryptGetProperty") and
        pe.imports("ncrypt.dll", "BCryptDecrypt") and
        pe.imports("ncrypt.dll", "BCryptEncrypt") and
        all of them
}
YARA Detection Rule: LOG_EXPL_ADSelfService_CVE_2021_40539_ADSLOG_Sep21
Repository: Neo23x0/signature-base
Detects: Detects suspicious log lines produeced during the exploitation of ADSelfService vulnerability CVE-2021-40539
Author: Florian Roth (Nextron Systems)
Reference: https://us-cert.cisa.gov/ncas/alerts/aa21-259a

Pattern signatures:
$x1 = "Java traceback errors that include references to NullPointerException in addSmartCardConfig or getSmartCardConfig" ascii wide

Detection condition:
filesize < 50MB and 1 of them

Full rule:
rule LOG_EXPL_ADSelfService_CVE_2021_40539_ADSLOG_Sep21 : LOG {
   meta:
      description = "Detects suspicious log lines produeced during the exploitation of ADSelfService vulnerability CVE-2021-40539"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://us-cert.cisa.gov/ncas/alerts/aa21-259a"
      date = "2021-09-20"
      score = 70
      id = "156317c6-e726-506d-8b07-4f74dae2807f"
   strings:
      $x1 = "Java traceback errors that include references to NullPointerException in addSmartCardConfig or getSmartCardConfig" ascii wide
   condition:
      filesize < 50MB and 1 of them
}
YARA Detection Rule: LOG_EXPL_ADSelfService_CVE_2021_40539_WebLog_Sep21_1
Repository: Neo23x0/signature-base
Detects: Detects suspicious log lines produeced during the exploitation of ADSelfService vulnerability CVE-2021-40539
Author: Florian Roth (Nextron Systems)
Reference: https://us-cert.cisa.gov/ncas/alerts/aa21-259a

Pattern signatures:
$x1 = "/ServletApi/../RestApi/LogonCustomization" ascii wide
      $x2 = "/ServletApi/../RestAPI/Connection" ascii wide

Detection condition:
filesize < 50MB and 1 of them

Full rule:
rule LOG_EXPL_ADSelfService_CVE_2021_40539_WebLog_Sep21_1 : LOG {
   meta:
      description = "Detects suspicious log lines produeced during the exploitation of ADSelfService vulnerability CVE-2021-40539"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://us-cert.cisa.gov/ncas/alerts/aa21-259a"
      date = "2021-09-20"
      score = 60
      id = "015957a6-8778-5836-af94-6e6d3838f693"
   strings:
      $x1 = "/ServletApi/../RestApi/LogonCustomization" ascii wide
      $x2 = "/ServletApi/../RestAPI/Connection" ascii wide
   condition:
      filesize < 50MB and 1 of them
}
YARA Detection Rule: APT_SH_CodeCov_Hack_Apr21_1
Repository: Neo23x0/signature-base
Detects: Detects manipulated Codecov bash uploader tool that has been manipulated by an unknown actor during March / April 2021
Author: Florian Roth (Nextron Systems)
Reference: https://about.codecov.io/security-update/

Pattern signatures:
$a1 = "Global report uploading tool for Codecov"

      $s1 = "curl -sm 0.5 -d"

Detection condition:
uint16(0) == 0x2123 and
      filesize < 70KB and
      all of them

Full rule:
rule APT_SH_CodeCov_Hack_Apr21_1 {
   meta:
      description = "Detects manipulated Codecov bash uploader tool that has been manipulated by an unknown actor during March / April 2021"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://about.codecov.io/security-update/"
      date = "2021-04-16"
      id = "b5fb74c4-073e-53af-a207-1672e63c9a64"
   strings:
      $a1 = "Global report uploading tool for Codecov"

      $s1 = "curl -sm 0.5 -d"
   condition:
      uint16(0) == 0x2123 and
      filesize < 70KB and
      all of them
}
YARA Detection Rule: Backdoor_Redosdru_Jun17
Repository: Neo23x0/signature-base
Detects: Detects malware Redosdru - file systemHome.exe
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/OOB3mH

Pattern signatures:
$x1 = "%s\\%d.gho" fullword ascii
      $x2 = "%s\\nt%s.dll" fullword ascii
      $x3 = "baijinUPdate" fullword ascii

      $s1 = "RegQueryValueEx(Svchost\\netsvcs)" fullword ascii
      $s2 = "serviceone" fullword ascii
      $s3 = "\x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#f \x1f#" fullword ascii
      $s4 = "servicetwo" fullword ascii
      $s5 = "UpdateCrc" fullword ascii
      $s6 = "\x1f#[ \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#" fullword ascii
      $s7 = "nwsaPAgEnT" fullword ascii
      $s8 = "%-24s %-15s 0x%x(%d) " fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 700KB and 1 of ($x*) or 4 of them )

Full rule:
rule Backdoor_Redosdru_Jun17 : HIGHVOL {
   meta:
      description = "Detects malware Redosdru - file systemHome.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/OOB3mH"
      date = "2017-06-04"
      hash1 = "4f49e17b457ef202ab0be905691ef2b2d2b0a086a7caddd1e70dd45e5ed3b309"
      id = "ea[PII_REDACTED]-5d08-ac89-70c1bbef716c"
   strings:
      $x1 = "%s\\%d.gho" fullword ascii
      $x2 = "%s\\nt%s.dll" fullword ascii
      $x3 = "baijinUPdate" fullword ascii

      $s1 = "RegQueryValueEx(Svchost\\netsvcs)" fullword ascii
      $s2 = "serviceone" fullword ascii
      $s3 = "\x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#f \x1f#" fullword ascii
      $s4 = "servicetwo" fullword ascii
      $s5 = "UpdateCrc" fullword ascii
      $s6 = "\x1f#[ \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#" fullword ascii
      $s7 = "nwsaPAgEnT" fullword ascii
      $s8 = "%-24s %-15s 0x%x(%d) " fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 700KB and 1 of ($x*) or 4 of them )
}
YARA Detection Rule: Backdoor_Nitol_Jun17
Repository: Neo23x0/signature-base
Detects: Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/OOB3mH

Pattern signatures:
$x1 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)" fullword ascii
      $x2 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
      $x3 = "TCPConnectFloodThread.target = %s" fullword ascii

      $s1 = "\\Program Files\\Internet Explorer\\iexplore.exe" ascii
      $s2 = "%c%c%c%c%c%c.exe" fullword ascii
      $s3 = "GET %s%s HTTP/1.1" fullword ascii
      $s4 = "CCAttack.target = %s" fullword ascii
      $s5 = "Accept-Language: zh-cn" fullword ascii
      $s6 = "jdfwkey" fullword ascii
      $s7 = "hackqz.f3322.org:8880" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($x*) or 5 of ($s*) ) ) or ( all of them )

Full rule:
rule Backdoor_Nitol_Jun17 {
   meta:
      description = "Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/OOB3mH"
      date = "2017-06-04"
      modified = "2023-01-07"
      hash1 = "cba19d228abf31ec8afab7330df3c9da60cd4dae376552b503aea6d7feff9946"
      id = "7dd26868-59e0-51a1-b12a-3b69d6246ff5"
   strings:
      $x1 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)" fullword ascii
      $x2 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
      $x3 = "TCPConnectFloodThread.target = %s" fullword ascii

      $s1 = "\\Program Files\\Internet Explorer\\iexplore.exe" ascii
      $s2 = "%c%c%c%c%c%c.exe" fullword ascii
      $s3 = "GET %s%s HTTP/1.1" fullword ascii
      $s4 = "CCAttack.target = %s" fullword ascii
      $s5 = "Accept-Language: zh-cn" fullword ascii
      $s6 = "jdfwkey" fullword ascii
      $s7 = "hackqz.f3322.org:8880" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($x*) or 5 of ($s*) ) ) or ( all of them )
}