deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT_Sandworm_User_May20_1
Repository: Neo23x0/signature-base
Detects: Detects user added by Sandworm on compromised machines
Author: Florian Roth (Nextron Systems)
Reference: https://media.defense.gov/2020/May/28/[PII_REDACTED]/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%[PII_REDACTED].pdf

Pattern signatures:
$s1 = "mysql_db:x:" ascii /* malicious user */

      $a1 = "root:x:"
      $a2 = "daemon:x:"

Detection condition:
filesize < 4KB and all of them

Full rule:
rule APT_Sandworm_User_May20_1 {
   meta:
      description = "Detects user added by Sandworm on compromised machines"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://media.defense.gov/2020/May/28/[PII_REDACTED]/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%[PII_REDACTED].pdf"
      date = "2020-05-28"
      hash1 = "dc074464e[PII_REDACTED]8ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
      hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
      id = "ada549a4-abcc-5c0a-9601-75631e78c835"
   strings:     
      $s1 = "mysql_db:x:" ascii /* malicious user */

      $a1 = "root:x:"
      $a2 = "daemon:x:"
   condition:
      filesize < 4KB and all of them
}
YARA Detection Rule: APT_WEBSHELL_PHP_Sandworm_May20_1
Repository: Neo23x0/signature-base
Detects: Detects GIF header PHP webshell used by Sandworm on compromised machines
Author: Florian Roth (Nextron Systems)
Reference: https://media.defense.gov/2020/May/28/[PII_REDACTED]/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%[PII_REDACTED].pdf

Pattern signatures:
$h1 = "GIF89a <?php $" ascii
      $s1 = "str_replace(" ascii

Detection condition:
filesize < 10KB and
      $h1 at 0 and $s1

Full rule:
rule APT_WEBSHELL_PHP_Sandworm_May20_1 {
   meta:
      description = "Detects GIF header PHP webshell used by Sandworm on compromised machines"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://media.defense.gov/2020/May/28/[PII_REDACTED]/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%[PII_REDACTED].pdf"
      date = "2020-05-28"
      hash1 = "dc074464e[PII_REDACTED]8ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
      hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
      id = "b9ec02c2-fa83-5f21-95cf-3528047b2d01"
   strings:     
      $h1 = "GIF89a <?php $" ascii
      $s1 = "str_replace(" ascii
   condition:
      filesize < 10KB and
      $h1 at 0 and $s1
}
YARA Detection Rule: APT_SH_Sandworm_Shell_Script_May20_1
Repository: Neo23x0/signature-base
Detects: Detects shell script used by Sandworm in attack against Exim mail server
Author: Florian Roth (Nextron Systems)
Reference: https://media.defense.gov/2020/May/28/[PII_REDACTED]/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%[PII_REDACTED].pdf

Pattern signatures:
$x1 = "echo \"GRANT ALL PRIVILEGES ON * . * TO 'mysqldb'@'localhost';\" >> init-file.txt" ascii fullword
      $x2 = "import base64,sys;exec(base64.b64decode({2:str,3:lambda b:bytes(b,'UTF-8')}[sys.version" ascii fullword
      $x3 = "sed -i -e '/PasswordAuthentication/s/no/yes/g; /PermitRootLogin/s/no/yes/g;" ascii fullword
      $x4 = "useradd -M -l -g root -G root -b /root -u 0 -o mysql_db" ascii fullword
      
      $s1 = "/ip.php?port=${PORT}\"" ascii fullword
      $s2 = "sed -i -e '/PasswordAuthentication" ascii fullword
      $s3 = "PATH_KEY=/root/.ssh/authorized_keys" ascii fullword
      $s4 = "CREATE USER" ascii fullword
      $s5 = "crontab -l | { cat; echo" ascii fullword
      $s6 = "mysqld --user=mysql --init-file=/etc/opt/init-file.txt --console" ascii fullword
      $s7 = "sshkey.php" ascii fullword

Detection condition:
uint16(0) == 0x2123 and
      filesize < 20KB and
      1 of ($x*) or 4 of them

Full rule:
rule APT_SH_Sandworm_Shell_Script_May20_1 {
   meta:
      description = "Detects shell script used by Sandworm in attack against Exim mail server"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://media.defense.gov/2020/May/28/[PII_REDACTED]/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%[PII_REDACTED].pdf"
      date = "2020-05-28"
      hash1 = "dc074464e[PII_REDACTED]8ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
      hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
      id = "21cf2c89-5511-5eb6-a2dd-4ad54ebfa2d1"
   strings:     
      $x1 = "echo \"GRANT ALL PRIVILEGES ON * . * TO 'mysqldb'@'localhost';\" >> init-file.txt" ascii fullword
      $x2 = "import base64,sys;exec(base64.b64decode({2:str,3:lambda b:bytes(b,'UTF-8')}[sys.version" ascii fullword
      $x3 = "sed -i -e '/PasswordAuthentication/s/no/yes/g; /PermitRootLogin/s/no/yes/g;" ascii fullword
      $x4 = "useradd -M -l -g root -G root -b /root -u 0 -o mysql_db" ascii fullword
      
      $s1 = "/ip.php?port=${PORT}\"" ascii fullword
      $s2 = "sed -i -e '/PasswordAuthentication" ascii fullword
      $s3 = "PATH_KEY=/root/.ssh/authorized_keys" ascii fullword
      $s4 = "CREATE USER" ascii fullword
      $s5 = "crontab -l | { cat; echo" ascii fullword
      $s6 = "mysqld --user=mysql --init-file=/etc/opt/init-file.txt --console" ascii fullword
      $s7 = "sshkey.php" ascii fullword
   condition:
      uint16(0) == 0x2123 and
      filesize < 20KB and
      1 of ($x*) or 4 of them
}
YARA Detection Rule: APT_RU_Sandworm_PY_May20_1
Repository: Neo23x0/signature-base
Detects: Detects Sandworm Python loader
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/billyleonard/status/[PII_REDACTED]25236482

Pattern signatures:
$x1 = "o.addheaders=[('User-Agent','Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko')]" ascii fullword
      
      $s1 = "exec(o.open('http://" ascii
      $s2 = "__import__({2:'urllib2',3:'urllib.request'}"

Detection condition:
uint16(0) == 0x6d69 and
      filesize < 1KB and
      1 of ($x*) or 2 of them

Full rule:
rule APT_RU_Sandworm_PY_May20_1 {
   meta:
      description = "Detects Sandworm Python loader"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/billyleonard/status/[PII_REDACTED]25236482"
      date = "2020-05-28"
      hash1 = "c025008463fdbf44b2f845f2d82702805d931771aea4b506573b83c8f58bccca"
      id = "a392d800-1fe8-5ae9-b813-e1dfcedecda6"
   strings:
      $x1 = "o.addheaders=[('User-Agent','Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko')]" ascii fullword
      
      $s1 = "exec(o.open('http://" ascii
      $s2 = "__import__({2:'urllib2',3:'urllib.request'}"
   condition:
      uint16(0) == 0x6d69 and
      filesize < 1KB and
      1 of ($x*) or 2 of them
}
YARA Detection Rule: APT_RU_Sandworm_PY_May20_2
Repository: Neo23x0/signature-base
Detects: Detects Sandworm Python loader
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/billyleonard/status/[PII_REDACTED]25236482

Pattern signatures:
$x1 = "import sys;import re, subprocess;cmd" ascii fullword
      $x2 = "UA='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';server='http"
      $x3 = "';t='/admin/get.php';req" ascii
      $x4 = "ps -ef | grep Little\\ Snitch | grep " ascii fullword

Detection condition:
uint16(0) == 0x6d69 and
      filesize < 2KB and
      1 of them

Full rule:
rule APT_RU_Sandworm_PY_May20_2 {
   meta:
      description = "Detects Sandworm Python loader"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/billyleonard/status/[PII_REDACTED]25236482"
      date = "2020-05-28"
      hash1 = "abfa83cf54db8fa548942acd845b4f34acc94c46d4e1fb5ce7e97cc0c6596676"
      id = "5b32ad64-d959-5632-a03c-17aa055b213f"
   strings:
      $x1 = "import sys;import re, subprocess;cmd" ascii fullword
      $x2 = "UA='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';server='http"
      $x3 = "';t='/admin/get.php';req" ascii
      $x4 = "ps -ef | grep Little\\ Snitch | grep " ascii fullword
   condition:
      uint16(0) == 0x6d69 and
      filesize < 2KB and
      1 of them
}
YARA Detection Rule: EXPL_React_Server_CVE_2025_55182_POC_Dec25
Repository: Neo23x0/signature-base
Detects: Detects in-memory webshell indicators related to the proof-of-concept code for the React Server Remote Code Execution Vulnerability (CVE-2025-55182)
Author: Florian Roth
Reference: https://x.com/pyn3rd/status/[PII_REDACTED]97954542/photo/1

Pattern signatures:
$xs1 = "{const cmd=p.query.cmd;if(!cmd)(s.writeHead(400);"

      $s1 = ";if(p.pathname=="
      $s2 = ".writeHead(400);"
      $s3 = ".writeHead(200,{'Content-Type':"
      $s4 = ".execSync("
      $s5 = ",stdio:'pipe'})"

Detection condition:
1 of ($x*)
      or all of ($s*)

Full rule:
rule EXPL_React_Server_CVE_2025_55182_POC_Dec25 {
   meta:
      description = "Detects in-memory webshell indicators related to the proof-of-concept code for the React Server Remote Code Execution Vulnerability (CVE-2025-55182)"
      author = "Florian Roth"
      reference = "https://x.com/pyn3rd/status/[PII_REDACTED]97954542/photo/1"
      date = "2025-12-05"
      score = 70
   strings:
      $xs1 = "{const cmd=p.query.cmd;if(!cmd)(s.writeHead(400);"

      $s1 = ";if(p.pathname=="
      $s2 = ".writeHead(400);"
      $s3 = ".writeHead(200,{'Content-Type':"
      $s4 = ".execSync("
      $s5 = ",stdio:'pipe'})"
   condition:
      1 of ($x*)
      or all of ($s*)
}
YARA Detection Rule: SUSP_WEBSHELL_LOG_Signatures_Dec25
Repository: Neo23x0/signature-base
Detects: Detects indicators related simple webshells that use the same exec/cmd pattern
Author: Florian Roth
Reference: https://x.com/pyn3rd/status/[PII_REDACTED]97954542/photo/1

Pattern signatures:
$xa1 = "/exec?cmd=ls"
      $xa2 = "/exec?cmd=whoami"
      $xa3 = "/exec?cmd=id"
      $xa4 = "/exec?cmd=uname%20-a"

Detection condition:
1 of them
      // not XML
      and not uint16(0) == 0x3c3f

Full rule:
rule SUSP_WEBSHELL_LOG_Signatures_Dec25 {
   meta:
      description = "Detects indicators related simple webshells that use the same exec/cmd pattern"
      author = "Florian Roth"
      reference = "https://x.com/pyn3rd/status/[PII_REDACTED]97954542/photo/1"
      date = "2025-12-05"
      score = 60
   strings:
      $xa1 = "/exec?cmd=ls"
      $xa2 = "/exec?cmd=whoami"
      $xa3 = "/exec?cmd=id"
      $xa4 = "/exec?cmd=uname%20-a"
   condition:
      1 of them
      // not XML
      and not uint16(0) == 0x3c3f
}
YARA Detection Rule: EXPL_RCE_React_Server_CVE_2025_55182_POC_Dec25
Repository: Neo23x0/signature-base
Detects: Detects RCE indicators related to the proof-of-concept code for the React Server Remote Code Execution Vulnerability (CVE-2025-55182)
Author: Florian Roth
Reference: https://www.youtube.com/watch?v=MmdwakT-Ve8

Pattern signatures:
$s1 = "process.mainModule.require('child_process').execSync("
      $s2 = "$1:constructor:constructor"

Detection condition:
all of them
      // not XML
      and not uint16(0) == 0x3c3f

Full rule:
rule EXPL_RCE_React_Server_CVE_2025_55182_POC_Dec25 {
   meta:
      description = "Detects RCE indicators related to the proof-of-concept code for the React Server Remote Code Execution Vulnerability (CVE-2025-55182)"
      author = "Florian Roth"
      reference = "https://www.youtube.com/watch?v=MmdwakT-Ve8"
      date = "2025-12-05"
      score = 70
   strings:
      $s1 = "process.mainModule.require('child_process').execSync("
      $s2 = "$1:constructor:constructor"
   condition:
      all of them
      // not XML
      and not uint16(0) == 0x3c3f
}
YARA Detection Rule: EXPL_RCE_React_Server_Next_JS_CVE_2025_66478_Tracebacks_Dec25
Repository: Neo23x0/signature-base
Detects: Detects traceback indicators caused by the exploitation of the React Server Remote Code Execution Vulnerability (CVE-2025-55182) in Next.js applications (CVE-2025-66478). This can also be caused by vulnerability scanning.
Author: Florian Roth
Reference: Internal Research

Pattern signatures:
$s1 = "Unexpected end of form"
      $s2 = "/next-server/app-page.runtime.dev.js:2:457"
      $s3 = "/app-page.runtime.dev.js:2:472"

Detection condition:
all of them

Full rule:
rule EXPL_RCE_React_Server_Next_JS_CVE_2025_66478_Tracebacks_Dec25 {
   meta:
      description = "Detects traceback indicators caused by the exploitation of the React Server Remote Code Execution Vulnerability (CVE-2025-55182) in Next.js applications (CVE-2025-66478). This can also be caused by vulnerability scanning."
      author = "Florian Roth"
      reference = "Internal Research"
      date = "2025-12-05"
      score = 55
   strings:
      $s1 = "Unexpected end of form"
      $s2 = "/next-server/app-page.runtime.dev.js:2:457"
      $s3 = "/app-page.runtime.dev.js:2:472"
   condition:
      all of them
}
YARA Detection Rule: EXPL_RCE_React_Server_Next_JS_CVE_2025_66478_Errors_Dec25
Repository: Neo23x0/signature-base
Detects: Detects error messages caused by the exploitation of the React Server Remote Code Execution Vulnerability (CVE-2025-55182) in Next.js applications (CVE-2025-66478). This can also be caused by vulnerability scanning.
Author: Florian Roth
Reference: https://github.com/Malayke/Next.js-RSC-RCE-Scanner-CVE-2025-66478

Pattern signatures:
$s1 = "[Error: NEXT_REDIRECT]"
      $s2 = "digest: 'uid=0(root) gid=0(root)"

Detection condition:
all of them

Full rule:
rule EXPL_RCE_React_Server_Next_JS_CVE_2025_66478_Errors_Dec25 {
   meta:
      description = "Detects error messages caused by the exploitation of the React Server Remote Code Execution Vulnerability (CVE-2025-55182) in Next.js applications (CVE-2025-66478). This can also be caused by vulnerability scanning."
      author = "Florian Roth"
      reference = "https://github.com/Malayke/Next.js-RSC-RCE-Scanner-CVE-2025-66478"
      date = "2025-12-05"
      score = 65
   strings:
      $s1 = "[Error: NEXT_REDIRECT]"
      $s2 = "digest: 'uid=0(root) gid=0(root)"
   condition:
      all of them
}
YARA Detection Rule: EXPL_SUSP_JS_POC_Dec25
Repository: Neo23x0/signature-base
Detects: Detects RCE indicators related to the proof-of-concept code for the React Server Remote Code Execution Vulnerability (CVE-2025-55182) but could be used in other JavaScript based PoC code as well
Author: Florian Roth
Reference: https://github.com/msanft/CVE-2025-55182/blob/main/poc.py

Pattern signatures:
$xr1 = /process\.mainModule\.require\(["']child_process["']\).{5,40}\(["'](whoami|powershell|\/bin\/sh|\/bin\/bash|wget|curl|cat \/etc\/passwd|uname|id["'])/

Detection condition:
1 of them
      // not XML
      and not uint16(0) == 0x3c3f

Full rule:
rule EXPL_SUSP_JS_POC_Dec25 {
   meta:
      description = "Detects RCE indicators related to the proof-of-concept code for the React Server Remote Code Execution Vulnerability (CVE-2025-55182) but could be used in other JavaScript based PoC code as well"
      author = "Florian Roth"
      reference = "https://github.com/msanft/CVE-2025-55182/blob/main/poc.py"
      date = "2025-12-05"
      modified = "2025-12-06"
      score = 70
   strings:
      $xr1 = /process\.mainModule\.require\(["']child_process["']\).{5,40}\(["'](whoami|powershell|\/bin\/sh|\/bin\/bash|wget|curl|cat \/etc\/passwd|uname|id["'])/
   condition:
      1 of them
      // not XML
      and not uint16(0) == 0x3c3f
}
YARA Detection Rule: EXPL_SUSP_JS_POC_RSC_Detector_Payloads_Dec25
Repository: Neo23x0/signature-base
Detects: Detects RCE indicators related to the proof-of-concept code for the React Server Remote Code Execution Vulnerability (CVE-2025-55182) as used in the RSC Detector browser extension but could be used in other JavaScript based PoC code as well
Author: Florian Roth
Reference: https://github.com/mrknow001/RSC_Detector

Pattern signatures:
$s1 = "process.mainModule.require('child_process').execSync("
      $s2 = ").toString('base64');"

      // harmless test cases - we only want to match real command execution attempts
      $f1 = "echo vulnerability_test"

Detection condition:
all of ($s*)
      and not 1 of ($f*)

Full rule:
rule EXPL_SUSP_JS_POC_RSC_Detector_Payloads_Dec25 {
   meta:
      description = "Detects RCE indicators related to the proof-of-concept code for the React Server Remote Code Execution Vulnerability (CVE-2025-55182) as used in the RSC Detector browser extension but could be used in other JavaScript based PoC code as well"
      author = "Florian Roth"
      reference = "https://github.com/mrknow001/RSC_Detector"
      date = "2025-12-06"
      score = 70
   strings:
      $s1 = "process.mainModule.require('child_process').execSync("
      $s2 = ").toString('base64');"

      // harmless test cases - we only want to match real command execution attempts
      $f1 = "echo vulnerability_test"
   condition:
      all of ($s*)
      and not 1 of ($f*)
}
YARA Detection Rule: EXPL_SUSP_JS_Exploitation_Payloads_Dec25
Repository: Neo23x0/signature-base
Detects: Detects RCE indicators related to the exploitation attempts of the React Server Remote Code Execution Vulnerability (CVE-2025-55182) as observed in the wild
Author: Florian Roth
Reference: https://www.greynoise.io/blog/cve-2025-55182-react2shell-opportunistic-exploitation-in-the-wild-what-the-greynoise-observation-grid-is-seeing-so-far

Pattern signatures:
$a1 = "process.mainModule.require('child_process')"

      $x1 = ".execSync('powershell -enc SQBFAFgAIAA"

      $sa1 = ".execSync('powershell"
      $sa2 = ".execSync('curl "
      $sa3 = ".execSync('wget "

      $sb01 = " -e "
      $sb02 = " -ec "
      $sb03 = " -en "
      $sb04 = " -enc "
      $sb05 = " -enco "
      $sb06 = " -encodedcommand "
      $sb07 = " | bash"
      $sb08 = " | sh"
      $sb09 = "|bash"
      $sb10 = "|sh"

      $sc1 = ").DownloadString(" ascii wide base64
      $sc2 = "IEX (New-Object " ascii wide base64

Detection condition:
$a1
      and (
         1 of ($x*)
         or (
            1 of ($sa*)
            and 1 of ($sb*)
         )
         or 1 of ($sc*)
      )

Full rule:
rule EXPL_SUSP_JS_Exploitation_Payloads_Dec25 {
   meta:
      description = "Detects RCE indicators related to the exploitation attempts of the React Server Remote Code Execution Vulnerability (CVE-2025-55182) as observed in the wild"
      author = "Florian Roth"
      reference = "https://www.greynoise.io/blog/cve-2025-55182-react2shell-opportunistic-exploitation-in-the-wild-what-the-greynoise-observation-grid-is-seeing-so-far"
      date = "2025-12-06"
      score = 70
   strings:
      $a1 = "process.mainModule.require('child_process')"

      $x1 = ".execSync('powershell -enc SQBFAFgAIAA"

      $sa1 = ".execSync('powershell"
      $sa2 = ".execSync('curl "
      $sa3 = ".execSync('wget "

      $sb01 = " -e "
      $sb02 = " -ec "
      $sb03 = " -en "
      $sb04 = " -enc "
      $sb05 = " -enco "
      $sb06 = " -encodedcommand "
      $sb07 = " | bash"
      $sb08 = " | sh"
      $sb09 = "|bash"
      $sb10 = "|sh"

      $sc1 = ").DownloadString(" ascii wide base64
      $sc2 = "IEX (New-Object " ascii wide base64
   condition:
      $a1
      and (
         1 of ($x*)
         or (
            1 of ($sa*)
            and 1 of ($sb*)
         )
         or 1 of ($sc*)
      )
}
YARA Detection Rule: OPCLEAVER_BackDoorLogger
Repository: Neo23x0/signature-base
Detects: Keylogger used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "BackDoorLogger"
		$s2 = "zhuAddress"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_BackDoorLogger
{
	meta:
		description = "Keylogger used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "e9149baa-83c0-597f-833c-ea0241bb60e6"
	strings:
		$s1 = "BackDoorLogger"
		$s2 = "zhuAddress"
	condition:
		all of them
}
YARA Detection Rule: OPCLEAVER_Jasus
Repository: Neo23x0/signature-base
Detects: ARP cache poisoner used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "pcap_dump_open"
		$s2 = "Resolving IPs to poison..."
		$s3 = "WARNNING: Gateway IP can not be found"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_Jasus
{
	meta:
		description = "ARP cache poisoner used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "8e04b258-e071-5974-9778-b9d0b97be8d5"
	strings:
		$s1 = "pcap_dump_open"
		$s2 = "Resolving IPs to poison..."
		$s3 = "WARNNING: Gateway IP can not be found"
	condition:
		all of them
}
YARA Detection Rule: OPCLEAVER_LoggerModule
Repository: Neo23x0/signature-base
Detects: Keylogger used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "%s-%02d%02d%02d%02d%02d.r"
		$s2 = "C:\\Users\\%s\\AppData\\Cookies\\"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_LoggerModule
{
	meta:
		description = "Keylogger used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "949e7ff4-2102-5c89-83c9-f7ba64745661"
	strings:
		$s1 = "%s-%02d%02d%02d%02d%02d.r"
		$s2 = "C:\\Users\\%s\\AppData\\Cookies\\"
	condition:
		all of them
}
YARA Detection Rule: OPCLEAVER_NetC
Repository: Neo23x0/signature-base
Detects: Net Crawler used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "NetC.exe" wide
		$s2 = "Net Service"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_NetC
{
	meta:
		description = "Net Crawler used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "68f32662-0d7d-5dfa-8bfd-ca41d383e19c"
	strings:
		$s1 = "NetC.exe" wide
		$s2 = "Net Service"
	condition:
		all of them
}
YARA Detection Rule: OPCLEAVER_ShellCreator2
Repository: Neo23x0/signature-base
Detects: Shell Creator used by attackers in Operation Cleaver to create ASPX web shells
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "ShellCreator2.Properties"
		$s2 = "set_IV"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_ShellCreator2
{
	meta:
		description = "Shell Creator used by attackers in Operation Cleaver to create ASPX web shells"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "b62336c3-39e5-55f8-98df-6c2a2cb0764a"
	strings:
		$s1 = "ShellCreator2.Properties"
		$s2 = "set_IV"
	condition:
		all of them
}
YARA Detection Rule: OPCLEAVER_SmartCopy2
Repository: Neo23x0/signature-base
Detects: Malware or hack tool used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "SmartCopy2.Properties"
		$s2 = "ZhuFrameWork"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_SmartCopy2
{
	meta:
		description = "Malware or hack tool used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "898d9060-208a-5dfb-a452-50ab49b80a9d"
	strings:
		$s1 = "SmartCopy2.Properties"
		$s2 = "ZhuFrameWork"
	condition:
		all of them
}