deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: apt_RU_MoonlightMaze_customlokitools
Repository: Neo23x0/signature-base
Detects: Rule to detect Moonlight Maze Loki samples by custom attacker-authored strings
Author: Kaspersky Lab
Reference: https://en.wikipedia.org/wiki/Moonlight_Maze

Pattern signatures:
$a1="Write file Ok..." ascii wide
	$a2="ERROR: Can not open socket...." ascii wide
	$a3="Error in parametrs:"  ascii wide
	$a4="Usage: @<get/put> <IP> <PORT> <file>"  ascii wide
	$a5="ERROR: Not connect..."  ascii wide
	$a6="Connect successful...."  ascii wide
	$a7="clnt <%d> rqstd n ll kll"  ascii wide
	$a8="clnt <%d> rqstd swap"  ascii wide
	$a9="cld nt sgnl prcs grp" ascii wide
	$a10="cld nt sgnl prnt" ascii wide

	//keeping only ascii version of string ->
	$a11="ork error" ascii fullword

Detection condition:
// Added filesize due to false positives with Nvidia drivers in process memory
	filesize < 5000KB and 3 of ($a*)

Full rule:
rule apt_RU_MoonlightMaze_customlokitools {

meta:

	author = "Kaspersky Lab"
	date = "2017-03-15"
	version = "1.1"
	last_modified = "2017-03-22"
	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
	description = "Rule to detect Moonlight Maze Loki samples by custom attacker-authored strings"
	hash = "14cce7e641d308c3a177a8abb5457019"
	hash = "a3164d2bbc45fb1eef5fde7eb8b245ea"
	hash = "dabee9a7ea0ddaf900ef1e3e166ffe8a"
	hash = "1980958afffb6a9d5a6c73fc1e2795c2"
	hash = "e59f92aadb6505f29a9f368ab803082e"

	id = "d5795d3b-bbb1-59e9-b86d-666b5c911f3b"
strings:

	$a1="Write file Ok..." ascii wide
	$a2="ERROR: Can not open socket...." ascii wide
	$a3="Error in parametrs:"  ascii wide
	$a4="Usage: @<get/put> <IP> <PORT> <file>"  ascii wide
	$a5="ERROR: Not connect..."  ascii wide
	$a6="Connect successful...."  ascii wide
	$a7="clnt <%d> rqstd n ll kll"  ascii wide
	$a8="clnt <%d> rqstd swap"  ascii wide
	$a9="cld nt sgnl prcs grp" ascii wide
	$a10="cld nt sgnl prnt" ascii wide

	//keeping only ascii version of string ->
	$a11="ork error" ascii fullword

condition:
	// Added filesize due to false positives with Nvidia drivers in process memory
	filesize < 5000KB and 3 of ($a*)
}
YARA Detection Rule: apt_RU_MoonlightMaze_customsniffer
Repository: Neo23x0/signature-base
Detects: Rule to detect Moonlight Maze sniffer tools
Author: Kaspersky Lab
Reference: https://en.wikipedia.org/wiki/Moonlight_Maze

Pattern signatures:
//strings from ora ->
	$a1="/var/tmp/gogo" fullword
	$a2="myfilename= |%s|" fullword
	$a3="mypid,mygid=" fullword
	$a4="mypid=|%d| mygid=|%d|" fullword

	//strings from tdn ->
	$a5="/var/tmp/task" fullword
	$a6="mydevname= |%s|" fullword

Detection condition:
2 of ($a*)

Full rule:
rule apt_RU_MoonlightMaze_customsniffer {

meta:

	author = "Kaspersky Lab"
	date = "2017-03-15"
	version = "1.1"
	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
	description = "Rule to detect Moonlight Maze sniffer tools"
	hash = "7b86f40e861705d59f5206c482e1f2a5"
	hash = "927426b558888ad680829bd34b0ad0e7"
	original_filename = "ora;tdn"

	id = "8cc76e4d-a956-543c-81e0-827dfdb5da1c"
strings:


	//strings from ora ->
	$a1="/var/tmp/gogo" fullword
	$a2="myfilename= |%s|" fullword
	$a3="mypid,mygid=" fullword
	$a4="mypid=|%d| mygid=|%d|" fullword

	//strings from tdn ->
	$a5="/var/tmp/task" fullword
	$a6="mydevname= |%s|" fullword

condition:
	2 of ($a*)
}
YARA Detection Rule: loki2crypto
Repository: Neo23x0/signature-base
Detects: Rule to detect hardcoded DH modulus used in 1996/1997 Loki2 sourcecode; #ifdef STRONG_CRYPTO /* 384-bit strong prime */
Author: Costin Raiu, Kaspersky Lab
Reference: https://en.wikipedia.org/wiki/Moonlight_Maze

Pattern signatures:
$modulus={DA E1 01 CD D8 C9 70 AF C2 E4 F2 7A 41 8B 43 39 52 9B 4B 4D E5 85 F8 49}

Detection condition:
(any of them)

Full rule:
rule loki2crypto {

meta:

	author = "Costin Raiu, Kaspersky Lab"
	date = "2017-03-21"
	version = "1.0"
	description = "Rule to detect hardcoded DH modulus used in 1996/1997 Loki2 sourcecode; #ifdef STRONG_CRYPTO /* 384-bit strong prime */"
	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
	hash = "19fbd8cbfb12482e8020a887d6427315"
	hash = "ea06b213d5924de65407e8931b1e4326"
	hash = "14ecd5e6fc8e501037b54ca263896a11"
	hash = "e079ec947d3d4dacb21e993b760a65dc"
	hash = "edf900cebb70c6d1fcab0234062bfc28"

	id = "d67288f8-5205-5882-8dff-041d092eea4f"
strings:

	$modulus={DA E1 01 CD D8 C9 70 AF C2 E4 F2 7A 41 8B 43 39 52 9B 4B 4D E5 85 F8 49}

condition:

	(any of them)

}
YARA Detection Rule: apt_RU_MoonlightMaze_de_tool
Repository: Neo23x0/signature-base
Detects: Rule to detect Moonlight Maze 'de' and 'deg' tunnel tool
Author: Kaspersky Lab
Reference: https://en.wikipedia.org/wiki/Moonlight_Maze

Pattern signatures:
$a1="Vnuk: %d" ascii fullword
	$a2="Syn: %d" ascii fullword

	//%s\r%s\r%s\r%s\r ->
	$a3={25 73 0A 25 73 0A 25 73 0A 25 73 0A}

Detection condition:
((2 of ($a*)))

Full rule:
rule apt_RU_MoonlightMaze_de_tool {

meta:

	author = "Kaspersky Lab"
	date = "2017-03-27"
	version = "1.0"
	last_modified = "2017-03-27"
	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
	description = "Rule to detect Moonlight Maze 'de' and 'deg' tunnel tool"
	hash = "4bc7ed168fb78f0dc688ee2be20c9703"
	hash = "8b56e8552a74133da4bc5939b5f74243"

	id = "09bfebca-7cec-5514-9f48-c0c2c57efcf9"
strings:

	$a1="Vnuk: %d" ascii fullword
	$a2="Syn: %d" ascii fullword

	//%s\r%s\r%s\r%s\r ->
	$a3={25 73 0A 25 73 0A 25 73 0A 25 73 0A}

condition:

	((2 of ($a*)))

}
YARA Detection Rule: apt_RU_MoonlightMaze_cle_tool
Repository: Neo23x0/signature-base
Detects: Rule to detect Moonlight Maze 'cle' log cleaning tool
Author: Kaspersky Lab
Reference: https://en.wikipedia.org/wiki/Moonlight_Maze

Pattern signatures:
$a1="./a filename template_file" ascii wide
	$a2="May be %s is empty?"  ascii wide
	$a3="template string = |%s|"   ascii wide
	$a4="No blocks !!!"
	$a5="No data in this block !!!!!!"  ascii wide
	$a6="No good line"

Detection condition:
((3 of ($a*)))

Full rule:
rule apt_RU_MoonlightMaze_cle_tool {

meta:

	author = "Kaspersky Lab"
	date = "2017-03-27"
	version = "1.0"
	last_modified = "2017-03-27"
	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
	description = "Rule to detect Moonlight Maze 'cle' log cleaning tool"
	hash = "647d7b711f7b4434145ea30d0ef207b0"


	id = "99ae07b9-eb42-53dc-bd8b-75ab6a0b8cab"
strings:

	$a1="./a filename template_file" ascii wide
	$a2="May be %s is empty?"  ascii wide
	$a3="template string = |%s|"   ascii wide
	$a4="No blocks !!!"
	$a5="No data in this block !!!!!!"  ascii wide
	$a6="No good line"

condition:

	((3 of ($a*)))

}
YARA Detection Rule: apt_RU_MoonlightMaze_xk_keylogger
Repository: Neo23x0/signature-base
Detects: Rule to detect Moonlight Maze 'xk' keylogger
Author: Kaspersky Lab
Reference: https://en.wikipedia.org/wiki/Moonlight_Maze

Pattern signatures:
$a1="Log ended at => %s"
	$a2="Log started at => %s [pid %d]"
	$a3="/var/tmp/task" fullword
	$a4="/var/tmp/taskhost" fullword
	$a5="my hostname: %s"
	$a6="/var/tmp/tasklog"
	$a7="/var/tmp/.Xtmp01" fullword
	$a8="myfilename=-%s-"
	$a9="/var/tmp/taskpid"
	$a10="mypid=-%d-" fullword
	$a11="/var/tmp/taskgid" fullword
	$a12="mygid=-%d-" fullword

Detection condition:
((3 of ($a*)))

Full rule:
rule apt_RU_MoonlightMaze_xk_keylogger {

meta:

	author = "Kaspersky Lab"
	date = "2017-03-27"
	version = "1.0"
	last_modified = "2017-03-27"
	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
	description = "Rule to detect Moonlight Maze 'xk' keylogger"

	id = "cf585cd0-afdd-5782-a6e5-bb9509cbf01d"
strings:

	$a1="Log ended at => %s"
	$a2="Log started at => %s [pid %d]"
	$a3="/var/tmp/task" fullword
	$a4="/var/tmp/taskhost" fullword
	$a5="my hostname: %s"
	$a6="/var/tmp/tasklog"
	$a7="/var/tmp/.Xtmp01" fullword
	$a8="myfilename=-%s-"
	$a9="/var/tmp/taskpid"
	$a10="mypid=-%d-" fullword
	$a11="/var/tmp/taskgid" fullword
	$a12="mygid=-%d-" fullword


condition:

	((3 of ($a*)))

}
YARA Detection Rule: apt_RU_MoonlightMaze_encrypted_keylog
Repository: Neo23x0/signature-base
Detects: Rule to detect Moonlight Maze encrypted keylogger logs
Author: Kaspersky Lab
Reference: https://en.wikipedia.org/wiki/Moonlight_Maze

Pattern signatures:
$a1={47 01 22 2A 6D 3E 39 2C}

Detection condition:
uint32(0) == 0x2a220147 and ($a1 at 0)

Full rule:
rule apt_RU_MoonlightMaze_encrypted_keylog {

meta:

	author = "Kaspersky Lab"
	date = "2017-03-27"
	version = "1.0"
	last_modified = "2017-03-27"
	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
	description = "Rule to detect Moonlight Maze encrypted keylogger logs"

	id = "f0d464f0-3955-5f41-a57f-8aa225e1171d"
strings:
	$a1={47 01 22 2A 6D 3E 39 2C}

condition:
	uint32(0) == 0x2a220147 and ($a1 at 0)

}
YARA Detection Rule: apt_RU_MoonlightMaze_IRIX_exploit_GEN
Repository: Neo23x0/signature-base
Detects: Rule to detect Irix exploits from David Hedley used by Moonlight Maze hackers
Author: Kaspersky Lab
Reference: https://en.wikipedia.org/wiki/Moonlight_Maze

Pattern signatures:
$a1="stack = 0x%x, targ_addr = 0x%x"
	$a2="execl failed"

Detection condition:
(uint32(0)==0x464c457f) and (all of them)

Full rule:
rule apt_RU_MoonlightMaze_IRIX_exploit_GEN {

meta:

	author = "Kaspersky Lab"
	date = "2017-03-27"
	version = "1.0"
	last_modified = "2017-03-27"
	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
	description = "Rule to detect Irix exploits from David Hedley used by Moonlight Maze hackers"
	reference2 = "https://www.exploit-db.com/exploits/19274/"
	hash = "008ea82f31f585622353bd47fa1d84be" //df3
	hash = "a26bad2b79075f454c83203fa00ed50c" //log
	hash = "f67fc6e90f05ba13f207c7fdaa8c2cab" //xconsole
	hash = "5937db3896cdd8b0beb3df44e509e136" //xlock
	hash = "f4ed5170dcea7e5ba62537d84392b280" //xterm

	id = "4f9ab7b0-4fb9-5311-ae23-01d0a9e2e104"
strings:

	$a1="stack = 0x%x, targ_addr = 0x%x"
	$a2="execl failed"

condition:

	(uint32(0)==0x464c457f) and (all of them)

}
YARA Detection Rule: apt_RU_MoonlightMaze_u_logcleaner
Repository: Neo23x0/signature-base
Detects: Rule to detect log cleaners based on utclean.c
Author: Kaspersky Lab
Reference: https://en.wikipedia.org/wiki/Moonlight_Maze

Pattern signatures:
$a1="Hiding complit...n"
	$a2="usage: %s <username> <fixthings> [hostname]"
	$a3="ls -la %s* ; /bin/cp  ./wtmp.tmp %s; rm  ./wtmp.tmp"

Detection condition:
(uint32(0)==0x464c457f) and (any of them)

Full rule:
rule apt_RU_MoonlightMaze_u_logcleaner {

meta:

	author = "Kaspersky Lab"
	date = "2017-03-27"
	version = "1.0"
	last_modified = "2017-03-27"
	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
	description = "Rule to detect log cleaners based on utclean.c"
	reference2 = "http://cd.textfiles.com/cuteskunk/Unix-Hacking-Exploits/utclean.c"
	hash = "d98796dcda1443a37b124dbdc041fe3b"
	hash = "73a518f0a73ab77033121d[PII_REDACTED]"

	id = "2dc1b796-c8fe-5a87-9d6b-3a322f4a43ab"
strings:

	$a1="Hiding complit...n"
	$a2="usage: %s <username> <fixthings> [hostname]"
	$a3="ls -la %s* ; /bin/cp  ./wtmp.tmp %s; rm  ./wtmp.tmp"

condition:

	(uint32(0)==0x464c457f) and (any of them)

}
YARA Detection Rule: apt_RU_MoonlightMaze_wipe
Repository: Neo23x0/signature-base
Detects: Rule to detect log cleaner based on wipe.c
Author: Kaspersky Lab
Reference: https://en.wikipedia.org/wiki/Moonlight_Maze

Pattern signatures:
$a1="ERROR: Unlinking tmp WTMP file."
	$a2="USAGE: wipe [ u|w|l|a ] ...options..."
	$a3="Erase acct entries on tty :   wipe a [username] [tty]"
	$a4="Alter lastlog entry       :   wipe l [username] [tty] [time] [host]"

Detection condition:
(uint32(0)==0x464c457f) and (2 of them)

Full rule:
rule apt_RU_MoonlightMaze_wipe {

meta:

	author = "Kaspersky Lab"
	date = "2017-03-27"
	version = "1.0"
	last_modified = "2017-03-27"
	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
	description = "Rule to detect log cleaner based on wipe.c"
	reference2 = "http://www.afn.org/~afn28925/wipe.c"
	hash = "e69efc504934551c6a77b525d5343241"

	id = "35060c3d-b805-54a6-a241-eb6e99168fa8"
strings:

	$a1="ERROR: Unlinking tmp WTMP file."
	$a2="USAGE: wipe [ u|w|l|a ] ...options..."
	$a3="Erase acct entries on tty :   wipe a [username] [tty]"
	$a4="Alter lastlog entry       :   wipe l [username] [tty] [time] [host]"

condition:

	(uint32(0)==0x464c457f) and (2 of them)

}
YARA Detection Rule: Trojan_ISMRAT_gen
Repository: Neo23x0/signature-base
Detects: ISM RAT
Author: Ahmed Zaki
Reference: https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2017/february/ism-rat/

Pattern signatures:
$s1 = "WinHTTP Example/1.0" wide
      $s2 = "Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0" wide
      $s3 = "|||Command executed successfully"
      $dir = /Microsoft\\Windows\\Tmpe[a-z0-9]{2,8}/

Detection condition:
uint16(0) == 0x5A4D and all of them

Full rule:
rule Trojan_ISMRAT_gen {
   meta:
      description = "ISM RAT"
      author = "Ahmed Zaki"
      reference = "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2017/february/ism-rat/"
      hash1 = "146a112cb01cd4b8e06d36304f6bdf7b"
      hash2 = "fa3dbe37108b752c38bf5870b5862ce5"
      hash3 = "bf4b07c7b4a4504c4192bd68476d63b5"
      id = "e72241ce-d6ee-5cb7-a83d-157161938d83"
   strings:
      $s1 = "WinHTTP Example/1.0" wide
      $s2 = "Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0" wide
      $s3 = "|||Command executed successfully"
      $dir = /Microsoft\\Windows\\Tmpe[a-z0-9]{2,8}/
   condition:
      uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT15_Malware_Mar18_RoyalCli
Repository: Neo23x0/signature-base
Detects: Detects malware from APT 15 report by NCC Group
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/HZ5XMN

Pattern signatures:
$s1 = "\\Release\\RoyalCli.pdb" ascii
      $s2 = "%snewcmd.exe" fullword ascii
      $s3 = "Run cmd error %d" fullword ascii
      $s4 = "%s~clitemp%08x.ini" fullword ascii
      $s5 = "run file failed" fullword ascii
      $s6 = "Cmd timeout %d" fullword ascii
      $s7 = "2 %s  %d 0 %d" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and 2 of them

Full rule:
rule APT15_Malware_Mar18_RoyalCli {
   meta:
      description = "Detects malware from APT 15 report by NCC Group"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/HZ5XMN"
      date = "2018-03-10"
      hash1 = "6df9b712ff56009810c4000a0ad47e41b7a6183b69416251e060b5c80cd05785"
      id = "165bfa6c-1a8d-5628-8c35-da4e4a2ae04f"
   strings:
      $s1 = "\\Release\\RoyalCli.pdb" ascii
      $s2 = "%snewcmd.exe" fullword ascii
      $s3 = "Run cmd error %d" fullword ascii
      $s4 = "%s~clitemp%08x.ini" fullword ascii
      $s5 = "run file failed" fullword ascii
      $s6 = "Cmd timeout %d" fullword ascii
      $s7 = "2 %s  %d 0 %d" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and 2 of them
}
YARA Detection Rule: APT15_Malware_Mar18_RoyalDNS
Repository: Neo23x0/signature-base
Detects: Detects malware from APT 15 report by NCC Group
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/HZ5XMN

Pattern signatures:
$x1 = "del c:\\windows\\temp\\r.exe /f /q" fullword ascii
      $x2 = "%s\\r.exe" fullword ascii

      $s1 = "rights.dll" fullword ascii
      $s2 = "\"%s\">>\"%s\"\\s.txt" fullword ascii
      $s3 = "Nwsapagent" fullword ascii
      $s4 = "%s\\r.bat" fullword ascii
      $s5 = "%s\\s.txt" fullword ascii
      $s6 = "runexe" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and (
        ( pe.exports("RunInstallA") and pe.exports("RunUninstallA") ) or
        1 of ($x*) or
        2 of them
      )

Full rule:
rule APT15_Malware_Mar18_RoyalDNS {
   meta:
      description = "Detects malware from APT 15 report by NCC Group"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/HZ5XMN"
      date = "2018-03-10"
      hash1 = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
      id = "c2f519db-2750-53ce-ae18-697ea041faaf"
   strings:
      $x1 = "del c:\\windows\\temp\\r.exe /f /q" fullword ascii
      $x2 = "%s\\r.exe" fullword ascii

      $s1 = "rights.dll" fullword ascii
      $s2 = "\"%s\">>\"%s\"\\s.txt" fullword ascii
      $s3 = "Nwsapagent" fullword ascii
      $s4 = "%s\\r.bat" fullword ascii
      $s5 = "%s\\s.txt" fullword ascii
      $s6 = "runexe" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and (
        ( pe.exports("RunInstallA") and pe.exports("RunUninstallA") ) or
        1 of ($x*) or
        2 of them
      )
}
YARA Detection Rule: APT15_Malware_Mar18_BS2005
Repository: Neo23x0/signature-base
Detects: Detects malware from APT 15 report by NCC Group
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/HZ5XMN

Pattern signatures:
$x1 = "AAAAKQAASCMAABi+AABnhEBj8vep7VRoAEPRWLweGc0/eiDrXGajJXRxbXsTXAcZAABK4QAAPWwAACzWAAByrg==" fullword ascii
      $x2 = "AAAAKQAASCMAABi+AABnhKv3kXJJousn5YzkjGF46eE3G8ZGse4B9uoqJo8Q2oF0AABK4QAAPWwAACzWAAByrg==" fullword ascii

      $a1 = "http://%s/content.html?id=%s" fullword ascii
      $a2 = "http://%s/main.php?ssid=%s" fullword ascii
      $a3 = "http://%s/webmail.php?id=%s" fullword ascii
      $a9 = "http://%s/error.html?tab=%s" fullword ascii

      $s1 = "%s\\~tmp.txt" fullword ascii
      $s2 = "%s /C %s >>\"%s\" 2>&1" fullword ascii
      $s3 = "DisableFirstRunCustomize" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and (
         1 of ($x*) or
         2 of them
      )

Full rule:
rule APT15_Malware_Mar18_BS2005 {
   meta:
      description = "Detects malware from APT 15 report by NCC Group"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/HZ5XMN"
      date = "2018-03-10"
      hash1 = "750d9eecd533f89b8aa13aeab173a1cf813b021b6824bc30e60f5db6fa7b950b"
      id = "700bbe14-d79e-5a35-aab3-31eacd5bd950"
   strings:
      $x1 = "AAAAKQAASCMAABi+AABnhEBj8vep7VRoAEPRWLweGc0/eiDrXGajJXRxbXsTXAcZAABK4QAAPWwAACzWAAByrg==" fullword ascii
      $x2 = "AAAAKQAASCMAABi+AABnhKv3kXJJousn5YzkjGF46eE3G8ZGse4B9uoqJo8Q2oF0AABK4QAAPWwAACzWAAByrg==" fullword ascii

      $a1 = "http://%s/content.html?id=%s" fullword ascii
      $a2 = "http://%s/main.php?ssid=%s" fullword ascii
      $a3 = "http://%s/webmail.php?id=%s" fullword ascii
      $a9 = "http://%s/error.html?tab=%s" fullword ascii

      $s1 = "%s\\~tmp.txt" fullword ascii
      $s2 = "%s /C %s >>\"%s\" 2>&1" fullword ascii
      $s3 = "DisableFirstRunCustomize" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and (
         1 of ($x*) or
         2 of them
      )
}
YARA Detection Rule: APT15_Malware_Mar18_MSExchangeTool
Repository: Neo23x0/signature-base
Detects: Detects malware from APT 15 report by NCC Group
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/HZ5XMN

Pattern signatures:
$s1 = "\\Release\\EWSTEW.pdb" ascii
      $s2 = "EWSTEW.exe" fullword wide
      $s3 = "Microsoft.Exchange.WebServices.Data" fullword ascii
      $s4 = "tmp.dat" fullword wide
      $s6 = "/v or /t is null" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 40KB and all of them

Full rule:
rule APT15_Malware_Mar18_MSExchangeTool {
   meta:
      description = "Detects malware from APT 15 report by NCC Group"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/HZ5XMN"
      date = "2018-03-10"
      hash1 = "16b868d1bef6be39f69b4e976595e7bd46b6c0595cf6bc482229dbb9e64f1bce"
      id = "81b826b6-8c2e-5a8a-a626-9515d40dbbb0"
   strings:
      $s1 = "\\Release\\EWSTEW.pdb" ascii
      $s2 = "EWSTEW.exe" fullword wide
      $s3 = "Microsoft.Exchange.WebServices.Data" fullword ascii
      $s4 = "tmp.dat" fullword wide
      $s6 = "/v or /t is null" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 40KB and all of them
}
YARA Detection Rule: clean_apt15_patchedcmd
Repository: Neo23x0/signature-base
Detects: This is a patched CMD. This is the CMD that RoyalCli uses.
Author: Ahmed Zaki

Pattern signatures:
$ = "eisableCMD" wide
      $ = "%WINDOWS_COPYRIGHT%" wide
      $ = "Cmd.Exe" wide
      $ = "Windows Command Processor" wide

Detection condition:
uint16(0) == 0x5A4D and all of them

Full rule:
rule clean_apt15_patchedcmd{
   meta:
      author = "Ahmed Zaki"
      description = "This is a patched CMD. This is the CMD that RoyalCli uses."
      sha256 = "90d1f65cfa51da07e040e066d4409dc8a48c1ab451542c894a623bc75c14bf8f"
      id = "c6867ad4-f7f2-5d63-bffd-07599ede635d"
   strings:
      $ = "eisableCMD" wide
      $ = "%WINDOWS_COPYRIGHT%" wide
      $ = "Cmd.Exe" wide
      $ = "Windows Command Processor" wide
   condition:
      uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: malware_apt15_royalcli_1
Repository: Neo23x0/signature-base
Detects: Generic strings found in the Royal CLI tool
Author: David Cannings

Pattern signatures:
$ = "%s~clitemp%08x.tmp" fullword
      $ = "%s /c %s>%s" fullword
      $ = "%snewcmd.exe" fullword
      $ = "%shkcmd.exe" fullword
      $ = "%s~clitemp%08x.ini" fullword
      $ = "myRObject" fullword
      $ = "myWObject" fullword
      $ = "2 %s  %d 0 %d\x0D\x0A"
      $ = "2 %s  %d 1 %d\x0D\x0A"
      $ = "%s file not exist" fullword

Detection condition:
uint16(0) == 0x5A4D and 5 of them

Full rule:
rule malware_apt15_royalcli_1{
   meta:
      description = "Generic strings found in the Royal CLI tool"
      author = "David Cannings"
      sha256 = "6df9b712ff56009810c4000a0ad47e41b7a6183b69416251e060b5c80cd05785"
      id = "432c09bf-3c44-5a2c-ba69-7b4fe7eb43cc"
   strings:
      $ = "%s~clitemp%08x.tmp" fullword
      $ = "%s /c %s>%s" fullword
      $ = "%snewcmd.exe" fullword
      $ = "%shkcmd.exe" fullword
      $ = "%s~clitemp%08x.ini" fullword
      $ = "myRObject" fullword
      $ = "myWObject" fullword
      $ = "2 %s  %d 0 %d\x0D\x0A"
      $ = "2 %s  %d 1 %d\x0D\x0A"
      $ = "%s file not exist" fullword
   condition:
      uint16(0) == 0x5A4D and 5 of them
}
YARA Detection Rule: malware_apt15_royalcli_2
Repository: Neo23x0/signature-base
Detects: APT15 RoyalCli backdoor
Author: Nikolaos Pantazopoulos

Pattern signatures:
$string1 = "%shkcmd.exe" fullword
      $string2 = "myRObject" fullword
      $string3 = "%snewcmd.exe" fullword
      $string4 = "%s~clitemp%08x.tmp" fullword
      $string6 = "myWObject" fullword

Detection condition:
uint16(0) == 0x5A4D and 2 of them

Full rule:
rule malware_apt15_royalcli_2{
   meta:
      author = "Nikolaos Pantazopoulos"
      description = "APT15 RoyalCli backdoor"
      id = "d4acfd2d-385d-5063-898e-d339b50733eb"
   strings:
      $string1 = "%shkcmd.exe" fullword
      $string2 = "myRObject" fullword
      $string3 = "%snewcmd.exe" fullword
      $string4 = "%s~clitemp%08x.tmp" fullword
      $string6 = "myWObject" fullword
   condition:
      uint16(0) == 0x5A4D and 2 of them
}