deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: T5000Strings
Repository: Yara-Rules/rules
Detects: T5000 Identifying Strings
Author: Seth Hardy

Pattern signatures:
$ = "_tmpR.vbs"
        $ = "_tmpg.vbs"
        $ = "Dtl.dat" wide ascii
        $ = "3C6FB3CA-69B1-454f-8B2F-BD157762810E"
        $ = "EED5CA6C-9958-4611-B7A7-1238F2E1B17E"
        $ = "8A8FF8AD-D1DE-4cef-B87C[PII_REDACTED]2E"
        $ = "43EE34A9-9063-4d2c-AACD-F5C62B849089"
        $ = "A8859547-C62D-4e8b-A82D-BE1479C684C9"
        $ = "A59CF429-D0DD-4207-88A1-04090680F714"
        $ = "utd_CE31" wide ascii
        $ = "f:\\Project\\T5000\\Src\\Target\\1 KjetDll.pdb"
        $ = "l:\\MyProject\\Vc 7.1\\T5000\\T5000Ver1.28\\Target\\4 CaptureDLL.pdb"
        $ = "f:\\Project\\T5000\\Src\\Target\\4 CaptureDLL.pdb"
        $ = "E:\\VS2010\\xPlat2\\Release\\InstRes32.pdb"

Detection condition:
any of them

Full rule:
rule T5000Strings : T5000 Family
{
    meta:
        description = "T5000 Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-06-26"
        
    strings:
        $ = "_tmpR.vbs"
        $ = "_tmpg.vbs"
        $ = "Dtl.dat" wide ascii
        $ = "3C6FB3CA-69B1-454f-8B2F-BD157762810E"
        $ = "EED5CA6C-9958-4611-B7A7-1238F2E1B17E"
        $ = "8A8FF8AD-D1DE-4cef-B87C[PII_REDACTED]2E"
        $ = "43EE34A9-9063-4d2c-AACD-F5C62B849089"
        $ = "A8859547-C62D-4e8b-A82D-BE1479C684C9"
        $ = "A59CF429-D0DD-4207-88A1-04090680F714"
        $ = "utd_CE31" wide ascii
        $ = "f:\\Project\\T5000\\Src\\Target\\1 KjetDll.pdb"
        $ = "l:\\MyProject\\Vc 7.1\\T5000\\T5000Ver1.28\\Target\\4 CaptureDLL.pdb"
        $ = "f:\\Project\\T5000\\Src\\Target\\4 CaptureDLL.pdb"
        $ = "E:\\VS2010\\xPlat2\\Release\\InstRes32.pdb"
        
    condition:
       any of them
}
YARA Detection Rule: T5000
Repository: Yara-Rules/rules
Detects: T5000
Author: Seth Hardy

Detection condition:
T5000Strings

Full rule:
rule T5000 : Family
{
    meta:
        description = "T5000"
        author = "Seth Hardy"
        last_modified = "2014-06-26"
        
    condition:
        T5000Strings
}
YARA Detection Rule: Mozart
Repository: Yara-Rules/rules
Detects: Detects samples of the Mozart POS RAM scraping utility
Author: Nick Hoffman - Morphick Inc
Reference: http://securitykitten.github.io/the-mozart-ram-scraper/

Pattern signatures:
$pdb = "z:\\Slender\\mozart\\mozart\\Release\\mozart.pdb" nocase wide ascii
       $output = {67 61 72 62 61 67 65 2E 74 6D 70 00}
       $service_name = "NCR SelfServ Platform Remote Monitor" nocase wide ascii
       $service_name_short = "NCR_RemoteMonitor"
       $encode_data = {B8 08 10 00 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 53 55 8B AC 24 14 10 00 00 89 84 24 0C 10 00 00 56 8B C5 33 F6 33 DB 8D 50 01 8D A4 24 00 00 00 00 8A 08 40 84 C9 ?? ?? 2B C2 89 44 24 0C ?? ?? 8B 94 24 1C 10 00 00 57 8B FD 2B FA 89 7C 24 10 ?? ?? 8B 7C 24 10 8A 04 17 02 86 E0 BA 40 00 88 02 B8 ?? ?? ?? ?? 46 8D 78 01 8D A4 24 00 00 00 00 8A 08 40 84 C9 ?? ?? 2B C7 3B F0 ?? ?? 33 F6 8B C5 43 42 8D 78 01 8A 08 40 84 C9 ?? ?? 2B C7 3B D8 ?? ?? 5F 8B B4 24 1C 10 00 00 8B C5 C6 04 33 00 8D 50 01 8A 08 40 84 C9 ?? ?? 8B 8C 24 20 10 00 00 2B C2 51 8D 54 24 14 52 50 56 E8 ?? ?? ?? ?? 83 C4 10 8B D6 5E 8D 44 24 0C 8B C8 5D 2B D1 5B 8A 08 88 0C 02 40 84 C9 ?? ?? 8B 8C 24 04 10 00 00 E8 ?? ?? ?? ?? 81 C4 08 10 00 00}

Detection condition:
any of ($pdb, $output, $encode_data) or
      all of ($service*)

Full rule:
rule Mozart
{
   meta:
       author = "Nick Hoffman - Morphick Inc"
       description = "Detects samples of the Mozart POS RAM scraping utility"
       reference = "http://securitykitten.github.io/the-mozart-ram-scraper/"
   strings:
       $pdb = "z:\\Slender\\mozart\\mozart\\Release\\mozart.pdb" nocase wide ascii
       $output = {67 61 72 62 61 67 65 2E 74 6D 70 00}
       $service_name = "NCR SelfServ Platform Remote Monitor" nocase wide ascii
       $service_name_short = "NCR_RemoteMonitor"
       $encode_data = {B8 08 10 00 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 53 55 8B AC 24 14 10 00 00 89 84 24 0C 10 00 00 56 8B C5 33 F6 33 DB 8D 50 01 8D A4 24 00 00 00 00 8A 08 40 84 C9 ?? ?? 2B C2 89 44 24 0C ?? ?? 8B 94 24 1C 10 00 00 57 8B FD 2B FA 89 7C 24 10 ?? ?? 8B 7C 24 10 8A 04 17 02 86 E0 BA 40 00 88 02 B8 ?? ?? ?? ?? 46 8D 78 01 8D A4 24 00 00 00 00 8A 08 40 84 C9 ?? ?? 2B C7 3B F0 ?? ?? 33 F6 8B C5 43 42 8D 78 01 8A 08 40 84 C9 ?? ?? 2B C7 3B D8 ?? ?? 5F 8B B4 24 1C 10 00 00 8B C5 C6 04 33 00 8D 50 01 8A 08 40 84 C9 ?? ?? 8B 8C 24 20 10 00 00 2B C2 51 8D 54 24 14 52 50 56 E8 ?? ?? ?? ?? 83 C4 10 8B D6 5E 8D 44 24 0C 8B C8 5D 2B D1 5B 8A 08 88 0C 02 40 84 C9 ?? ?? 8B 8C 24 04 10 00 00 E8 ?? ?? ?? ?? 81 C4 08 10 00 00}
   condition:
      any of ($pdb, $output, $encode_data) or
      all of ($service*)
}
YARA Detection Rule: MacGyverCap
Repository: Yara-Rules/rules
Detects: Generic rule for MacGyver.cap
Author: xylitol@temari.fr
Reference: https://github.com/fboldewin/MacGyver-s-return---An-EMV-Chip-cloning-case/blob/master/MacGyver's%20return%20-%20An%20EMV%20Chip%20cloning%20case.pdf

Pattern signatures:
$string1 = "src/MacGyver/javacard/Header.cap" ascii wide
        $string2 = "src/MacGyver/javacard/Directory.cap" ascii wide
		$string3 = "src/MacGyver/javacard/Applet.cap" ascii wide
		$string4 = "src/MacGyver/javacard/Import.cap" ascii wide
		$string5 = "src/MacGyver/javacard/ConstantPool.cap" ascii wide
		$string6 = "src/MacGyver/javacard/Class.cap" ascii wide
		$string7 = "src/MacGyver/javacard/Method.cap" ascii wide

Detection condition:
all of them

Full rule:
rule MacGyverCap : MacGyver
{
    meta:
        description = "Generic rule for MacGyver.cap"
        author = "xylitol@temari.fr"
        date = "2021-05-11"
        reference = "https://github.com/fboldewin/MacGyver-s-return---An-EMV-Chip-cloning-case/blob/master/MacGyver's%20return%20-%20An%20EMV%20Chip%20cloning%20case.pdf"
        // May only the challenge guide you
		hash1 = "9dc70002e82c78ee34c813597925c6cf8aa8d68b7e9ce5bcc70ea9bcab9dbf4a"		
    strings:
        $string1 = "src/MacGyver/javacard/Header.cap" ascii wide
        $string2 = "src/MacGyver/javacard/Directory.cap" ascii wide
		$string3 = "src/MacGyver/javacard/Applet.cap" ascii wide
		$string4 = "src/MacGyver/javacard/Import.cap" ascii wide
		$string5 = "src/MacGyver/javacard/ConstantPool.cap" ascii wide
		$string6 = "src/MacGyver/javacard/Class.cap" ascii wide
		$string7 = "src/MacGyver/javacard/Method.cap" ascii wide
    condition:  
         all of them
}
YARA Detection Rule: MacGyverCapInstaller
Repository: Yara-Rules/rules
Detects: Generic rule for Hacktool:Win32/EMVSoft who install MacGyver.cap
Author: xylitol@temari.fr
Reference: https://github.com/fboldewin/MacGyver-s-return---An-EMV-Chip-cloning-case/blob/master/MacGyver's%20return%20-%20An%20EMV%20Chip%20cloning%20case.pdf

Pattern signatures:
$string1 = "delete -AID 315041592e5359532e[PII_REDACTED]" ascii wide
        $string2 = "install -file MacGyver.cap -nvDataLimit 1000 -instParam 00 -priv 4" ascii wide
		$string3 = "-mac_key[PII_REDACTED][PII_REDACTED]4a4b4c4d4e4f" ascii wide
		$string4 = "-enc_key[PII_REDACTED][PII_REDACTED]4a4b4c4d4e4f" ascii wide

Detection condition:
all of them

Full rule:
rule MacGyverCapInstaller : MacGyvercap Installer
{
    meta:
        description = "Generic rule for Hacktool:Win32/EMVSoft who install MacGyver.cap"
        author = "xylitol@temari.fr"
        date = "2021-05-11"
        reference = "https://github.com/fboldewin/MacGyver-s-return---An-EMV-Chip-cloning-case/blob/master/MacGyver's%20return%20-%20An%20EMV%20Chip%20cloning%20case.pdf"
        // May only the challenge guide you
		hash1 = "bb828eb0bbebabbcb51f490f4a0c08dd798b1f350dddddb6c00abcb6f750069f"
		hash2 = "04f0c9904675c7cf80ff1962bec5ef465ccf8c29e668f3158ec262414a6cc6eb"
		hash3 = "7335cd56a9ac08c200cca7e25b939e9c4ffa4d508207e68bee01904bf20a6528"
		hash4 = "af542ccb415647dbd80df902858a3d150a85f37992a35f29999eed76ac01a12b"
		hash5 = "247484124f4879bfacaae73ea32267e2c1e89773986df70a5f3456b1fb944c58"
		hash6 = "1cc8a2f3ce12f4b8356bda8b4aaf61d510d1078112af1c14cf4583090e062fbe"
		hash7 = "c23411deeec790e2dba37f4c49c7ecac3c867b7012431c9281ed748519eda65c"
		hash8 = "c0d11ed2eed0fef8d2f53920a1e12f667e03eafdb2d2941473d120e9e6f0e657"
		hash9 = "1ecfd3755eba578108363c0705c6ec[PII_REDACTED]39ed0fbd17439f8139ba7e08" 
		hash10 = "87678c6dcf0065ffc487a284b9f79bd8c0815c5c621fc92f83df24393bfcc660"
    strings:
        $string1 = "delete -AID 315041592e5359532e[PII_REDACTED]" ascii wide
        $string2 = "install -file MacGyver.cap -nvDataLimit 1000 -instParam 00 -priv 4" ascii wide
		$string3 = "-mac_key[PII_REDACTED][PII_REDACTED]4a4b4c4d4e4f" ascii wide
		$string4 = "-enc_key[PII_REDACTED][PII_REDACTED]4a4b4c4d4e4f" ascii wide
    condition:  
         all of them
}
YARA Detection Rule: DoublePulsarXor_Petya
Repository: Yara-Rules/rules
Detects: Rule to hit on the XORed DoublePulsar shellcode
Author: Patrick Jones

Pattern signatures:
$DoublePulsarXor_Petya = { FD 0C 8C 5C B8 C4 24 C5 CC CC CC 0E E8 CC 24 6B CC CC CC 0F 24 CD CC CC CC 27 5C 97 75 BA CD CC CC C3 FE }

Detection condition:
$DoublePulsarXor_Petya

Full rule:
rule DoublePulsarXor_Petya
{
 meta:
   description = "Rule to hit on the XORed DoublePulsar shellcode"
   author = "Patrick Jones"
   company = "Booz Allen Hamilton"
   reference1 ="https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html"
   reference2 = "https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf"
   date = "2017-06-28"
   hash = "027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745"
   hash = "64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1"
 strings:
   $DoublePulsarXor_Petya = { FD 0C 8C 5C B8 C4 24 C5 CC CC CC 0E E8 CC 24 6B CC CC CC 0F 24 CD CC CC CC 27 5C 97 75 BA CD CC CC C3 FE }
 condition:
   $DoublePulsarXor_Petya
}
YARA Detection Rule: DoublePulsarDllInjection_Petya
Repository: Yara-Rules/rules
Detects: Rule to hit on the XORed DoublePulsar DLL injection shellcode
Author: Patrick Jones

Pattern signatures:
$DoublePulsarDllInjection_Petya = { 45 20 8D 93 8D 92 8D 91 8D 90 92 93 91 97 0F 9F 9E 9D 99 84 45 29 84 4D 20 CC CD CC CC 9B 84 45 03 84 45 14 84 45 49 CC 33 33 33 24 77 CC CC CC 84 45 49 C4 33 33 33 24 84 CD CC CC 84 45 49 DC 33 33 33 84 47 49 CC 33 33 33 84 47 41 }

Detection condition:
$DoublePulsarDllInjection_Petya

Full rule:
rule DoublePulsarDllInjection_Petya
{
 meta:
  description = "Rule to hit on the XORed DoublePulsar DLL injection shellcode"
  author = "Patrick Jones"
  company = "Booz Allen Hamilton"
  reference1 ="https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html"
  reference2 = "https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf"
  date = "2017-06-28"
  hash = "027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745"
  hash = "64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1" 
 strings:
   $DoublePulsarDllInjection_Petya = { 45 20 8D 93 8D 92 8D 91 8D 90 92 93 91 97 0F 9F 9E 9D 99 84 45 29 84 4D 20 CC CD CC CC 9B 84 45 03 84 45 14 84 45 49 CC 33 33 33 24 77 CC CC CC 84 45 49 C4 33 33 33 24 84 CD CC CC 84 45 49 DC 33 33 33 84 47 49 CC 33 33 33 84 47 41 }
 condition:
   $DoublePulsarDllInjection_Petya
}
YARA Detection Rule: Cobalt_functions
Repository: Yara-Rules/rules
Detects: Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Author: @j0sm1
Reference: https://www.securityartwork.es/2017/06/16/analisis-del-powershell-usado-fin7/

Pattern signatures:
$h1={58 A4 53 E5} // VirtualAllocEx
        $h2={4C 77 26 07} // LoadLibraryEx
        $h3={6A C9 9C C9} // DNSQuery_UTF8
        $h4={44 F0 35 E0} // Sleep
        $h5={F4 00 8E CC} // lstrlen

Detection condition:
2 of ( $h* )

Full rule:
rule Cobalt_functions
{

    meta:

        author="@j0sm1"
        url="https://www.securityartwork.es/2017/06/16/analisis-del-powershell-usado-fin7/"
        description="Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT"

    strings:

        $h1={58 A4 53 E5} // VirtualAllocEx
        $h2={4C 77 26 07} // LoadLibraryEx
        $h3={6A C9 9C C9} // DNSQuery_UTF8
        $h4={44 F0 35 E0} // Sleep
        $h5={F4 00 8E CC} // lstrlen

    condition:
        2 of ( $h* )
}
YARA Detection Rule: EliseLotusBlossom
Repository: Yara-Rules/rules
Detects: Elise Backdoor Trojan
Author: Jose Ramon Palanco

Pattern signatures:
$magic = { 4d 5a }
    $s1 = "\",Update" wide
    $s2 = "LoaderDLL.dll"
    $s3 = "Kernel32.dll"
    $s4 = "{5947BACD-63BF-4e73-95D7-0C8A98AB95F2}"
    $s5 = "\\Network\\" wide
    $s6 = "0SSSSS"
    $s7 = "[PII_REDACTED]05"
    $s8 = "0WWWWW"

Detection condition:
$magic at 0 and all of ($s*)

Full rule:
rule EliseLotusBlossom
{

meta:
    author = "Jose Ramon Palanco"
    date = "2015-06-23"
    description = "Elise Backdoor Trojan"
    ref = "https://www.paloaltonetworks.com/resources/research/unit42-operation-lotus-blossom.html"

strings:
    $magic = { 4d 5a }
    $s1 = "\",Update" wide
    $s2 = "LoaderDLL.dll"
    $s3 = "Kernel32.dll"
    $s4 = "{5947BACD-63BF-4e73-95D7-0C8A98AB95F2}"
    $s5 = "\\Network\\" wide
    $s6 = "0SSSSS"
    $s7 = "[PII_REDACTED]05"
    $s8 = "0WWWWW"

condition:
    $magic at 0 and all of ($s*)    
}
YARA Detection Rule: PoS_Malware_MalumPOS
Repository: Yara-Rules/rules
Detects: Used to detect MalumPOS memory dumper
Author: Trend Micro, Inc.

Pattern signatures:
$string1 = "SOFTWARE\\Borland\\Delphi\\RTL"
        $string2 = "B)[0-9]{13,19}\\"
        $string3 = "[A-Za-z\\s]{0,30}\\/[A-Za-z\\s]{0,30}\\"
        $string4 = "TRegExpr(exec): ExecNext Without Exec[Pos]"
        $string5 = /Y:\\PROGRAMS\\.{20,300}\.pas/

Detection condition:
all of ($string*)

Full rule:
rule PoS_Malware_MalumPOS
{
    meta:
        author = "Trend Micro, Inc."
        date = "2015-05-25"
        description = "Used to detect MalumPOS memory dumper"
        sample_filtype = "exe"
    strings:
        $string1 = "SOFTWARE\\Borland\\Delphi\\RTL"
        $string2 = "B)[0-9]{13,19}\\"
        $string3 = "[A-Za-z\\s]{0,30}\\/[A-Za-z\\s]{0,30}\\"
        $string4 = "TRegExpr(exec): ExecNext Without Exec[Pos]"
        $string5 = /Y:\\PROGRAMS\\.{20,300}\.pas/ 
    condition:
        all of ($string*)
}
YARA Detection Rule: PlugXStrings
Repository: Yara-Rules/rules
Detects: PlugX Identifying Strings
Author: Seth Hardy

Pattern signatures:
$BootLDR = "boot.ldr" wide ascii
        $Dwork = "d:\\work" nocase
        $Plug25 = "plug2.5"
        $Plug30 = "Plug3.0"
        $Shell6 = "Shell6"

Detection condition:
$BootLDR or ($Dwork and ($Plug25 or $Plug30 or $Shell6))

Full rule:
rule PlugXStrings : PlugX Family
{
    meta:
        description = "PlugX Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-06-12"
        
    strings:
        $BootLDR = "boot.ldr" wide ascii
        $Dwork = "d:\\work" nocase
        $Plug25 = "plug2.5"
        $Plug30 = "Plug3.0"
        $Shell6 = "Shell6"
      
    condition:
        $BootLDR or ($Dwork and ($Plug25 or $Plug30 or $Shell6))
}
YARA Detection Rule: plugX
Repository: Yara-Rules/rules
Detects: PlugX RAT
Author: Jean-Philippe Teissier / @Jipe_

Pattern signatures:
$v1a = { 47 55 4C 50 00 00 00 00 }
		$v1b = "/update?id=%8.8x" 
		$v1algoa = { BB 33 33 33 33 2B } 
		$v1algob = { BB 44 44 44 44 2B } 
		$v2a = "Proxy-Auth:" 
		$v2b = { 68 A0 02 00 00 } 
		$v2k = { C1 8F 3A 71 }

Detection condition:
$v1a at 0 or $v1b or (($v2a or $v2b) and (($v1algoa and $v1algob) or $v2k))

Full rule:
rule plugX : rat
{
	meta:
		author = "Jean-Philippe Teissier / @Jipe_"
		description = "PlugX RAT"
		date = "2014-05-13"
		filetype = "memory"
		version = "1.0" 
		ref1 = "https://github.com/mattulm/IR-things/blob/master/volplugs/plugx.py"
		
	strings:
		$v1a = { 47 55 4C 50 00 00 00 00 }
		$v1b = "/update?id=%8.8x" 
		$v1algoa = { BB 33 33 33 33 2B } 
		$v1algob = { BB 44 44 44 44 2B } 
		$v2a = "Proxy-Auth:" 
		$v2b = { 68 A0 02 00 00 } 
		$v2k = { C1 8F 3A 71 } 
		
	condition: 
		$v1a at 0 or $v1b or (($v2a or $v2b) and (($v1algoa and $v1algob) or $v2k))
}
YARA Detection Rule: PlugX_mw
Repository: Yara-Rules/rules
Detects: Malware creates a randomized directory within the appdata roaming directory and launches the malware. Should see multiple events for create process rundll32.exe and iexplorer.exe as it repeatedly uses iexplorer to launch the rundll32 process.
Author: https://github.com/reed1713
Reference: http://www.fireeye.com/blog/technical/targeted-attack/2014/02/operation-greedywonk-multiple-economic-and-foreign-policy-sites-compromised-serving-up-flash-zero-day-exploit.html

Pattern signatures:
$type="Microsoft-Windows-Security-Auditing"
		$eventid="4688"
		$data=/\\AppData\\Roaming\\[0-9]{9,12}\VMwareCplLauncher\.exe/

		$type1="Microsoft-Windows-Security-Auditing"
		$eventid1="4688"
		$data1="\\Windows\\System32\\rundll32.exe"

		$type2="Microsoft-Windows-Security-Auditing"
		$eventid2="4688"
		$data2="Program Files\\Internet Explorer\\iexplore.exe"

Detection condition:
all of them

Full rule:
rule PlugX_mw
{ 
	meta:
		maltype = "plugX"
		author = "https://github.com/reed1713"
		reference = "http://www.fireeye.com/blog/technical/targeted-attack/2014/02/operation-greedywonk-multiple-economic-and-foreign-policy-sites-compromised-serving-up-flash-zero-day-exploit.html"
		description = "Malware creates a randomized directory within the appdata roaming directory and launches the malware. Should see multiple events for create process rundll32.exe and iexplorer.exe as it repeatedly uses iexplorer to launch the rundll32 process."
	strings:
		$type="Microsoft-Windows-Security-Auditing"
		$eventid="4688"
		$data=/\\AppData\\Roaming\\[0-9]{9,12}\VMwareCplLauncher\.exe/

		$type1="Microsoft-Windows-Security-Auditing"
		$eventid1="4688"
		$data1="\\Windows\\System32\\rundll32.exe"

		$type2="Microsoft-Windows-Security-Auditing"
		$eventid2="4688"
		$data2="Program Files\\Internet Explorer\\iexplore.exe"
	condition:
		all of them
}
YARA Detection Rule: with_sqlite
Repository: Yara-Rules/rules
Detects: Rule to detect the presence of SQLite data in raw image
Author: Julian J. Gonzalez <info@seguridadparatodos.es>
Reference: http://www.st2labs.com

Pattern signatures:
$hex_string = {53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00}

Detection condition:
all of them

Full rule:
rule with_sqlite : sqlite
{
	meta:
		author = "Julian J. Gonzalez <info@seguridadparatodos.es>"
		reference = "http://www.st2labs.com"
		description = "Rule to detect the presence of SQLite data in raw image"
	strings:
		$hex_string = {53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00}
	condition:
		all of them
}
YARA Detection Rule: Regin_APT_KernelDriver_Generic_A
Repository: Yara-Rules/rules
Detects: Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2
Author: @Malwrsignatures - included in APT Scanner THOR

Pattern signatures:
$m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 } 
        $m1 = { 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e }    
        $s0 = "atapi.sys" fullword wide
        $s1 = "disk.sys" fullword wide
        $s3 = "h.data" fullword ascii
        $s4 = "\\system32" fullword ascii
        $s5 = "\\SystemRoot" fullword ascii
        $s6 = "system" fullword ascii
        $s7 = "temp" fullword ascii
        $s8 = "windows" fullword ascii
        $x1 = "LRich6" fullword ascii
        $x2 = "KeServiceDescriptorTable" fullword ascii

Detection condition:
$m0 at 0 and $m1 and all of ($s*) and 1 of ($x*)

Full rule:
rule Regin_APT_KernelDriver_Generic_A 
{

    meta:
        description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
        author = "@Malwrsignatures - included in APT Scanner THOR"
        date = "23.11.14"
        hash1 = "187044596bc1328efa0ed636d8aa4a5c"
        hash2 = "06665b96e293b23acc80451abb413e50"
        hash3 = "d240f06e98c8d3e647cbf4d442d79475"

    strings:
        $m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 } 
        $m1 = { 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e }    
        $s0 = "atapi.sys" fullword wide
        $s1 = "disk.sys" fullword wide
        $s3 = "h.data" fullword ascii
        $s4 = "\\system32" fullword ascii
        $s5 = "\\SystemRoot" fullword ascii
        $s6 = "system" fullword ascii
        $s7 = "temp" fullword ascii
        $s8 = "windows" fullword ascii
        $x1 = "LRich6" fullword ascii
        $x2 = "KeServiceDescriptorTable" fullword ascii     
    
    condition:
        $m0 at 0 and $m1 and all of ($s*) and 1 of ($x*)
}
YARA Detection Rule: Regin_APT_KernelDriver_Generic_C
Repository: Yara-Rules/rules
Detects: Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2
Author: @Malwrsignatures - included in APT Scanner THOR

Pattern signatures:
$m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 }    
        $s0 = "KeGetCurrentIrql" fullword ascii
        $s1 = "5.2.3790.0 (srv03_rtm[PII_REDACTED])" fullword wide
        $s2 = "usbclass" fullword wide
        $x1 = "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" ascii
        $x2 = "Universal Serial Bus Class Driver" fullword wide
        $x3 = "5.2.3790.0" fullword wide
        $y1 = "LSA Shell" fullword wide
        $y2 = "0Richw" fullword ascii

Detection condition:
$m0 at 0 and all of ($s*) and ( all of ($x*) or all of ($y*) )  and filesize < 20KB

Full rule:
rule Regin_APT_KernelDriver_Generic_C 
{

    meta:
        description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
        author = "@Malwrsignatures - included in APT Scanner THOR"
        date = "23.11.14"
        hash1 = "e[PII_REDACTED]e0b45b312383814ec6783556d7635"
        hash2 = "732298fa025ed48179a3a2555b45be96f7079712"      

    strings:
        $m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 }    
        $s0 = "KeGetCurrentIrql" fullword ascii
        $s1 = "5.2.3790.0 (srv03_rtm[PII_REDACTED])" fullword wide
        $s2 = "usbclass" fullword wide
        $x1 = "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" ascii
        $x2 = "Universal Serial Bus Class Driver" fullword wide
        $x3 = "5.2.3790.0" fullword wide
        $y1 = "LSA Shell" fullword wide
        $y2 = "0Richw" fullword ascii       
    
    condition:
        $m0 at 0 and all of ($s*) and ( all of ($x*) or all of ($y*) )  and filesize < 20KB
}
YARA Detection Rule: Regin_sig_svcsstat
Repository: Yara-Rules/rules
Detects: Detects svcstat from Regin report - file svcsstat.exe_sample
Author: @MalwrSignatures

Pattern signatures:
$s0 = "Service Control Manager" fullword ascii
        $s1 = "_vsnwprintf" fullword ascii
        $s2 = "Root Agency" fullword ascii
        $s3 = "Root Agency0" fullword ascii
        $s4 = "StartServiceCtrlDispatcherA" fullword ascii
        $s5 = "\\\\?\\UNC" fullword wide
        $s6 = "%ls%ls" fullword wide

Detection condition:
all of them and filesize < 15KB and filesize > 10KB

Full rule:
rule Regin_sig_svcsstat 
{

    meta:
        description = "Detects svcstat from Regin report - file svcsstat.exe_sample"
        author = "@MalwrSignatures"
        date = "26.11.14"
        hash = "5164edc1d54f10b7cb00a266a1b52c623ab005e2"

    strings:
        $s0 = "Service Control Manager" fullword ascii
        $s1 = "_vsnwprintf" fullword ascii
        $s2 = "Root Agency" fullword ascii
        $s3 = "Root Agency0" fullword ascii
        $s4 = "StartServiceCtrlDispatcherA" fullword ascii
        $s5 = "\\\\?\\UNC" fullword wide
        $s6 = "%ls%ls" fullword wide

    condition:
        all of them and filesize < 15KB and filesize > 10KB 
}