deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: HKTL_NET_GUID_SharpNamedPipePTH
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/S3cur3Th1sSh1t/SharpNamedPipePTH

Pattern signatures:
$typelibguid0 = "344ee55a-4e32-46f2-a003-69ad52b55945" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpNamedPipePTH {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/S3cur3Th1sSh1t/SharpNamedPipePTH"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-11-30"
        id = "561b95a5-f32b-5fe8-9e67-3f702306be93"
    strings:
        $typelibguid0 = "344ee55a-4e32-46f2-a003-69ad52b55945" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpTokenFinder
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/HuskyHacks/SharpTokenFinder

Pattern signatures:
$typelibguid0 = "572804d3-dbd6-450a-be64-2e3cb54fd173" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpTokenFinder {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/HuskyHacks/SharpTokenFinder"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-12-06"
        id = "60fd06be-041b-5fa8-8f25-41b26605ea90"
    strings:
        $typelibguid0 = "572804d3-dbd6-450a-be64-2e3cb54fd173" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpRODC
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/wh0amitz/SharpRODC

Pattern signatures:
$typelibguid0 = "d305f8a3-019a-4cdf-909c-069d5b483613" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpRODC {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/wh0amitz/SharpRODC"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-12-06"
        id = "60779e7a-048f-5095-b853-fd90c4f7449e"
    strings:
        $typelibguid0 = "d305f8a3-019a-4cdf-909c-069d5b483613" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_GMSAPasswordReader
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/rvazarkar/GMSAPasswordReader

Pattern signatures:
$typelibguid0 = "c8112750-972d-4efa-a75b-da9b8a4533c7" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_GMSAPasswordReader {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/rvazarkar/GMSAPasswordReader"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-12-06"
        id = "dc74bfce-90a1-53bd-bfe4-cb7c9c75da53"
    strings:
        $typelibguid0 = "c8112750-972d-4efa-a75b-da9b8a4533c7" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpShareFinder
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/mvelazc0/SharpShareFinder

Pattern signatures:
$typelibguid0 = "64bfeb18-b65c-4a83-bde0-b54363b09b71" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpShareFinder {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/mvelazc0/SharpShareFinder"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-12-19"
        id = "bb485347-ea9b-5f26-99ad-bedc38bfecd5"
    strings:
        $typelibguid0 = "64bfeb18-b65c-4a83-bde0-b54363b09b71" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_POSTDump
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/YOLOP0wn/POSTDump

Pattern signatures:
$typelibguid0 = "e54195f0-060c-4b24-98f2-ad9fb5351045" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_POSTDump {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/YOLOP0wn/POSTDump"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-12-19"
        id = "7f33e76c-0227-5c23-b821-c5c9753e2384"
    strings:
        $typelibguid0 = "e54195f0-060c-4b24-98f2-ad9fb5351045" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: MAL_LNX_PLAGUE_BACKDOOR_Jul25
Repository: Neo23x0/signature-base
Detects: Detects Plague backdoor ELF binaries, related to PAM authentication alteration.
Author: Pezier Pierre-Henri
Reference: Internal Research

Pattern signatures:
$s1 = "decrypt_phrase"
      $s2 = "init_phrases"

      $x1 = "captured_password"
      $x2 = "updateklog"
      $x3 = "init_cred_structs"

      $xop1 = {
         48 8b [4] 00    // mov     rax, cs:_ent_ptr
         8b 00           // mov     eax, [rax]
         3d ca b2 e9 f1  // cmp     eax, 0F1E9B2CAh
         74              // jz      short loc_4586
      }

Detection condition:
uint32be(0) == 0x7f454c46
      and filesize < 1MB
      and 2 of them

Full rule:
rule MAL_LNX_PLAGUE_BACKDOOR_Jul25 {
   meta:
      description = "Detects Plague backdoor ELF binaries, related to PAM authentication alteration."
      reference = "Internal Research"
      author = "Pezier Pierre-Henri"
      date = "2025-07-25"
      score = 80
      hash = "14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39"
      hash = "7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e"
   strings:
      $s1 = "decrypt_phrase"
      $s2 = "init_phrases"

      $x1 = "captured_password"
      $x2 = "updateklog"
      $x3 = "init_cred_structs"

      $xop1 = {
         48 8b [4] 00    // mov     rax, cs:_ent_ptr
         8b 00           // mov     eax, [rax]
         3d ca b2 e9 f1  // cmp     eax, 0F1E9B2CAh
         74              // jz      short loc_4586
      }
   condition:
      uint32be(0) == 0x7f454c46
      and filesize < 1MB
      and 2 of them
}
YARA Detection Rule: MAL_CoralWave_LenovoSPKVOL_RemcosMicDrop
Repository: Neo23x0/signature-base
Detects: CoralWave loader masquerading as Lenovo audio DLL. Drops Remcos RAT.
Author: xstp
Reference: https://bazaar.abuse.ch/sample/050edadedd7947bc6418f7856a29df5b7b5550bf5eec7f5f37e9a7e1713036f6/

Pattern signatures:
$stub_1 = "BAyXuHpAGwdG8ebXF3GvZ32vO3ORY" ascii
        $stub_2 = "IK5HT1XPlj3LoFkKi3YC4QwYQs7s" ascii
        $stub_3 = "Xmk61GHDjDfjUjJhNjwDPXxM1Cdg" ascii

        $fake_1 = "GetVolumeLevel" ascii
        $fake_2 = "OpenSpeakerVolumeInterface" ascii
        $fake_3 = "SetMuteState" ascii

        $mutex = "Rmc-245S33" wide ascii
        $log_file = "logs.dat" wide ascii
        $audio_folder = "MicRecords" wide ascii

Detection condition:
filesize < 5MB and uint16(0) == 0x5A4D and
        (
            2 of ($stub_*) or
            (2 of ($fake_*) and 1 of ($mutex, $log_file, $audio_folder))
        )

Full rule:
rule MAL_CoralWave_LenovoSPKVOL_RemcosMicDrop {
    meta:
        description = "CoralWave loader masquerading as Lenovo audio DLL. Drops Remcos RAT."
        author = "xstp"
        date = "2026-01-01"
        reference = "https://bazaar.abuse.ch/sample/050edadedd7947bc6418f7856a29df5b7b5550bf5eec7f5f37e9a7e1713036f6/"
        hash = "65302b435a5bc30e8f[PII_REDACTED]635ec50b5b1caba9e55f9258d17c7238be54"
        score = 85

    strings:
        $stub_1 = "BAyXuHpAGwdG8ebXF3GvZ32vO3ORY" ascii
        $stub_2 = "IK5HT1XPlj3LoFkKi3YC4QwYQs7s" ascii
        $stub_3 = "Xmk61GHDjDfjUjJhNjwDPXxM1Cdg" ascii

        $fake_1 = "GetVolumeLevel" ascii
        $fake_2 = "OpenSpeakerVolumeInterface" ascii
        $fake_3 = "SetMuteState" ascii

        $mutex = "Rmc-245S33" wide ascii
        $log_file = "logs.dat" wide ascii
        $audio_folder = "MicRecords" wide ascii

    condition:
        filesize < 5MB and uint16(0) == 0x5A4D and
        (
            2 of ($stub_*) or
            (2 of ($fake_*) and 1 of ($mutex, $log_file, $audio_folder))
        )
}
YARA Detection Rule: LokiBot_Dropper_ScanCopyPDF_Feb18
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file Scan Copy.pdf.com
Author: Florian Roth (Nextron Systems)
Reference: https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5

Pattern signatures:
$x1 = "Win32           Scan Copy.pdf   " fullword wide

      $a1 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" fullword ascii

      $s1 = "Compiling2.exe" fullword wide
      $s2 = "Unstalled2" fullword ascii
      $s3 = "Compiling.exe" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and $x1 or
      ( $a1 and 1 of ($s*) )

Full rule:
rule LokiBot_Dropper_ScanCopyPDF_Feb18 {
   meta:
      description = "Auto-generated rule - file Scan Copy.pdf.com"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5"
      date = "2018-02-14"
      hash1 = "6f8ff26a5daf47effdea5795cdadfff9265c93a0ebca0ce5a4144712f8cab5be"
      id = "64c45d91-4e18-5fd1-8d93-b5db4df7da29"
   strings:
      $x1 = "Win32           Scan Copy.pdf   " fullword wide

      $a1 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" fullword ascii

      $s1 = "Compiling2.exe" fullword wide
      $s2 = "Unstalled2" fullword ascii
      $s3 = "Compiling.exe" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and $x1 or
      ( $a1 and 1 of ($s*) )
}
YARA Detection Rule: LokiBot_Dropper_Packed_R11_Feb18
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file scan copy.pdf.r11
Author: Florian Roth (Nextron Systems)
Reference: https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5

Pattern signatures:
$s1 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" fullword ascii

Detection condition:
uint16(0) == 0x0000 and filesize < 2000KB and 1 of them

Full rule:
rule LokiBot_Dropper_Packed_R11_Feb18 {
   meta:
      description = "Auto-generated rule - file scan copy.pdf.r11"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5"
      date = "2018-02-14"
      hash1 = "3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029"
      id = "83cd6225-eb6d-5d17-a751-51f20db9c7eb"
   strings:
      $s1 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" fullword ascii
   condition:
      uint16(0) == 0x0000 and filesize < 2000KB and 1 of them
}
YARA Detection Rule: HKTL_NET_Edge_Saved_Passwords_Dumper_May26
Repository: Neo23x0/signature-base
Detects: Detects an .NET based tool used to dump saved passwords from Microsoft Edge browser processes
Author: Florian Roth
Reference: https://github.com/L1v1ng0ffTh3L4N/Proof-of-Concepts/tree/main/EdgeSavedPasswordsDumper

Pattern signatures:
$x1 = "SELECT ProcessId, Name, ParentProcessId FROM Win32_Process WHERE Name='msedge.exe'" wide
      $x2 = "Scanning process PID: " wide

      $s1 = "NSC\\t1_" wide
      $s2 = "\\*\\(\\)_\\-\\+=\\{\\}\\[\\]:;<>\\?/~\\s]{6,40})\\x20\\x00" wide

Detection condition:
2 of them

Full rule:
rule HKTL_NET_Edge_Saved_Passwords_Dumper_May26 {
   meta:
      description = "Detects an .NET based tool used to dump saved passwords from Microsoft Edge browser processes"
      author = "Florian Roth"
      reference = "https://github.com/L1v1ng0ffTh3L4N/Proof-of-Concepts/tree/main/EdgeSavedPasswordsDumper"
      date = "2026-05-05"
      score = 80
   strings:
      $x1 = "SELECT ProcessId, Name, ParentProcessId FROM Win32_Process WHERE Name='msedge.exe'" wide
      $x2 = "Scanning process PID: " wide

      $s1 = "NSC\\t1_" wide
      $s2 = "\\*\\(\\)_\\-\\+=\\{\\}\\[\\]:;<>\\?/~\\s]{6,40})\\x20\\x00" wide
   condition:
      2 of them
}
YARA Detection Rule: php_anuna
Repository: Yara-Rules/rules
Detects: Catches a PHP Trojan
Author: Vlad https://github.com/vlad-s

Pattern signatures:
$a = /<\?php \$[a-z]+ = '/
        $b = /\$[a-z]+=explode\(chr\(\([0-9]+[-+][0-9]+\)\)/
        $c = /\$[a-z]+=\([0-9]+[-+][0-9]+\)/
        $d = /if \(!function_exists\('[a-z]+'\)\)/

Detection condition:
all of them

Full rule:
rule php_anuna
{
    meta:
        author      = "Vlad https://github.com/vlad-s"
        date        = "2016/07/18"
        description = "Catches a PHP Trojan"
    strings:
        $a = /<\?php \$[a-z]+ = '/
        $b = /\$[a-z]+=explode\(chr\(\([0-9]+[-+][0-9]+\)\)/
        $c = /\$[a-z]+=\([0-9]+[-+][0-9]+\)/
        $d = /if \(!function_exists\('[a-z]+'\)\)/
    condition:
        all of them
}
YARA Detection Rule: chinese_spam_spreader
Repository: Yara-Rules/rules
Detects: Catches chinese PHP spam files (autospreaders)
Author: Vlad https://github.com/vlad-s

Pattern signatures:
$a = "User-Agent: aQ0O010O"
        $b = "<font color='red'><b>Connection Error!</b></font>"
        $c = /if ?\(\$_POST\[Submit\]\) ?{/

Detection condition:
all of them

Full rule:
rule chinese_spam_spreader : webshell
{
    meta:
        author      = "Vlad https://github.com/vlad-s"
        date        = "2016/07/18"
        description = "Catches chinese PHP spam files (autospreaders)"
    strings:
        $a = "User-Agent: aQ0O010O"
        $b = "<font color='red'><b>Connection Error!</b></font>"
        $c = /if ?\(\$_POST\[Submit\]\) ?{/
    condition:
        all of them
}
YARA Detection Rule: chinese_spam_echoer
Repository: Yara-Rules/rules
Detects: Catches chinese PHP spam files (printers)
Author: Vlad https://github.com/vlad-s

Pattern signatures:
$a = "set_time_limit(0)"
        $b = "date_default_timezone_set('PRC');"
        $c = "$Content_mb;"
        $d = "/index.php?host="

Detection condition:
all of them

Full rule:
rule chinese_spam_echoer : webshell
{
    meta:
        author      = "Vlad https://github.com/vlad-s"
        date        = "2016/07/18"
        description = "Catches chinese PHP spam files (printers)"
    strings:
        $a = "set_time_limit(0)"
        $b = "date_default_timezone_set('PRC');"
        $c = "$Content_mb;"
        $d = "/index.php?host="
    condition:
        all of them
}
YARA Detection Rule: Backdoor_WebShell_asp
Repository: Yara-Rules/rules
Detects: Detect ASPXSpy
Author: xylitol@temari.fr

Pattern signatures:
$string1 = "CmdShell" wide ascii
    $string2 = "ADSViewer" wide ascii
    $string3 = "ASPXSpy.Bin" wide ascii
    $string4 = "PortScan" wide ascii
    $plugin = "Test.AspxSpyPlugins" wide ascii

Detection condition:
3 of ($string*) or $plugin

Full rule:
rule Backdoor_WebShell_asp : ASPXSpy
{
    meta:
    description= "Detect ASPXSpy"
    author = "xylitol@temari.fr"
    date = "2019-02-26"
    // May only the challenge guide you
    strings:
    $string1 = "CmdShell" wide ascii
    $string2 = "ADSViewer" wide ascii
    $string3 = "ASPXSpy.Bin" wide ascii
    $string4 = "PortScan" wide ascii
    $plugin = "Test.AspxSpyPlugins" wide ascii
 
    condition:
    3 of ($string*) or $plugin
}
YARA Detection Rule: Dotico_PHP_webshell
Repository: Yara-Rules/rules
Detects: .ico PHP webshell - file <eight-num-letter-chars>.ico
Author: Luis Fueris
Reference: https://rankinstudio.com/Drupal_ico_index_hack

Pattern signatures:
$php = "<?php" ascii
        $regexp = /basename\/\*[a-z0-9]{,6}\*\/\(\/\*[a-z0-9]{,5}\*\/trim\/\*[a-z0-9]{,5}\*\/\(\/\*[a-z0-9]{,5}\*\//

Detection condition:
$php at 0 and $regexp and filesize > 70KB and filesize < 110KB

Full rule:
rule Dotico_PHP_webshell : webshell {
    meta:
        description = ".ico PHP webshell - file <eight-num-letter-chars>.ico"
        author = "Luis Fueris"
        reference = "https://rankinstudio.com/Drupal_ico_index_hack"
        date = "2019/12/04"
    strings:
        $php = "<?php" ascii
        $regexp = /basename\/\*[a-z0-9]{,6}\*\/\(\/\*[a-z0-9]{,5}\*\/trim\/\*[a-z0-9]{,5}\*\/\(\/\*[a-z0-9]{,5}\*\//
    condition:
        $php at 0 and $regexp and filesize > 70KB and filesize < 110KB
}
YARA Detection Rule: fire2013
Repository: Yara-Rules/rules
Detects: Catches a webshell
Author: Vlad https://github.com/vlad-s

Pattern signatures:
$a = "eval(\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6C\\x61"
        $b = "yc0CJYb+O//Xgj9/y+U/dd//vkf'\\x29\\x29\\x29\\x3B\")"

Detection condition:
all of them

Full rule:
rule fire2013 : webshell
{
    meta:
        author      = "Vlad https://github.com/vlad-s"
        date        = "2016/07/18"
        description = "Catches a webshell"
    strings:
        $a = "eval(\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6C\\x61"
        $b = "yc0CJYb+O//Xgj9/y+U/dd//vkf'\\x29\\x29\\x29\\x3B\")"
    condition:
        all of them
}
YARA Detection Rule: php_in_image
Repository: Yara-Rules/rules
Detects: Finds image files w/ PHP code in images
Author: Vlad https://github.com/vlad-s

Pattern signatures:
$gif = /^GIF8[79]a/
        $jfif = { ff d8 ff e? 00 10 4a 46 49 46 }
        $png = { 89 50 4e 47 0d 0a 1a 0a }

        $php_tag = "<?php"

Detection condition:
(($gif at 0) or
        ($jfif at 0) or
        ($png at 0)) and

        $php_tag

Full rule:
rule php_in_image
{
    meta:
        author      = "Vlad https://github.com/vlad-s"
        date        = "2016/07/18"
        description = "Finds image files w/ PHP code in images"
    strings:
        $gif = /^GIF8[79]a/
        $jfif = { ff d8 ff e? 00 10 4a 46 49 46 }
        $png = { 89 50 4e 47 0d 0a 1a 0a }

        $php_tag = "<?php"
    condition:
        (($gif at 0) or
        ($jfif at 0) or
        ($png at 0)) and

        $php_tag
}
YARA Detection Rule: Weevely_Webshell
Repository: Yara-Rules/rules
Detects: Weevely Webshell - Generic Rule - heavily scrambled tiny web shell
Author: Florian Roth
Reference: http://www.ehacking.net/2014/12/weevely-php-stealth-web-backdoor-kali.html

Pattern signatures:
$php = "<?php" ascii
		$s0 = /\$[a-z]{4} = \$[a-z]{4}\("[a-z][a-z]?",[\s]?"",[\s]?"/ ascii
		$s1 = /\$[a-z]{4} = str_replace\("[a-z][a-z]?","","/ ascii
		$s2 = /\$[a-z]{4}\.\$[a-z]{4}\.\$[a-z]{4}\.\$[a-z]{4}\)\)\); \$[a-z]{4}\(\);/ ascii
		$s4 = /\$[a-z]{4}="[a-zA-Z0-9]{70}/ ascii

Detection condition:
$php at 0 and all of ($s*) and filesize > 570 and filesize < 800

Full rule:
rule Weevely_Webshell : webshell {
	meta:
		description = "Weevely Webshell - Generic Rule - heavily scrambled tiny web shell"
		author = "Florian Roth"
		reference = "http://www.ehacking.net/2014/12/weevely-php-stealth-web-backdoor-kali.html"
		date = "2014/12/14"
		score = 60
	strings:
		$php = "<?php" ascii
		$s0 = /\$[a-z]{4} = \$[a-z]{4}\("[a-z][a-z]?",[\s]?"",[\s]?"/ ascii
		$s1 = /\$[a-z]{4} = str_replace\("[a-z][a-z]?","","/ ascii
		$s2 = /\$[a-z]{4}\.\$[a-z]{4}\.\$[a-z]{4}\.\$[a-z]{4}\)\)\); \$[a-z]{4}\(\);/ ascii
		$s4 = /\$[a-z]{4}="[a-zA-Z0-9]{70}/ ascii
	condition:
		$php at 0 and all of ($s*) and filesize > 570 and filesize < 800
}
YARA Detection Rule: webshell_h4ntu_shell_powered_by_tsoi_
Repository: Yara-Rules/rules
Detects: Web Shell - file h4ntu shell [powered by tsoi].php
Author: Florian Roth

Pattern signatures:
$s0 = "  <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><b>Server Adress:</b"
		$s3 = "  <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><b>User Info:</b> ui"
		$s4 = "    <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><?= $info ?>: <?= "
		$s5 = "<INPUT TYPE=\"text\" NAME=\"cmd\" value=\"<?php echo stripslashes(htmlentities($"

Detection condition:
all of them

Full rule:
rule webshell_h4ntu_shell_powered_by_tsoi_  : webshell {
	meta:
		description = "Web Shell - file h4ntu shell [powered by tsoi].php"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "06ed0b2398f8096f1bebf092d0526137"
	strings:
		$s0 = "  <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><b>Server Adress:</b"
		$s3 = "  <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><b>User Info:</b> ui"
		$s4 = "    <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><?= $info ?>: <?= "
		$s5 = "<INPUT TYPE=\"text\" NAME=\"cmd\" value=\"<?php echo stripslashes(htmlentities($"
	condition:
		all of them
}
YARA Detection Rule: webshell_PHP_sql
Repository: Yara-Rules/rules
Detects: Web Shell - file sql.php
Author: Florian Roth

Pattern signatures:
$s0 = "$result=mysql_list_tables($db) or die (\"$h_error<b>\".mysql_error().\"</b>$f_"
		$s4 = "print \"<a href=\\\"$_SERVER[PHP_SELF]?s=$s&login=$login&[CREDENTIAL_REDACTED]"

Detection condition:
all of them

Full rule:
rule webshell_PHP_sql  : webshell {
	meta:
		description = "Web Shell - file sql.php"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "2cf20a207695bbc2311a998d1d795c35"
	strings:
		$s0 = "$result=mysql_list_tables($db) or die (\"$h_error<b>\".mysql_error().\"</b>$f_"
		$s4 = "print \"<a href=\\\"$_SERVER[PHP_SELF]?s=$s&login=$login&[CREDENTIAL_REDACTED]"
	condition:
		all of them
}
YARA Detection Rule: webshell_PHP_a
Repository: Yara-Rules/rules
Detects: Web Shell - file a.php
Author: Florian Roth

Pattern signatures:
$s1 = "echo \"<option value=\\\"\". strrev(substr(strstr(strrev($work_dir), \"/\""
		$s2 = "echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>"
		$s4 = "<input name=\"submit_btn\" type=\"submit\" value=\"Execute Command\"></p> " fullword

Detection condition:
2 of them

Full rule:
rule webshell_PHP_a : webshell {
	meta:
		description = "Web Shell - file a.php"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "e3b461f7464d81f5022419d87315a90d"
	strings:
		$s1 = "echo \"<option value=\\\"\". strrev(substr(strstr(strrev($work_dir), \"/\""
		$s2 = "echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>"
		$s4 = "<input name=\"submit_btn\" type=\"submit\" value=\"Execute Command\"></p> " fullword
	condition:
		2 of them
}