deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: SUSP_Four_Byte_XOR_PE_And_MZ
Repository: Neo23x0/signature-base
Detects: Look for 4 byte xor of a PE starting at offset 0
Author: Wesley Shields <wxs@atarininja.org>
Reference: https://gist.github.com/wxsBSD/bf7b88b27e9f879016b5ce2c778d3e83

Detection condition:
uint16(0) != 0x5a4d and
      uint32(0x28) != 0x00000000 and
      uint32(0x28) == uint32(0x2c) and
      uint32(uint32(0x3c) ^ uint32(0x28)) ^ uint32(0x28) == 0x00004550

Full rule:
rule SUSP_Four_Byte_XOR_PE_And_MZ {
   meta:
      author = "Wesley Shields <wxs@atarininja.org>"
      description = "Look for 4 byte xor of a PE starting at offset 0"
      reference = "https://gist.github.com/wxsBSD/bf7b88b27e9f879016b5ce2c778d3e83"
      score = 60
      date = "2021-10-11"
      id = "d7b4b462-dfde-5d1f-8[PII_REDACTED]6c15f"
   condition:
      uint16(0) != 0x5a4d and
      uint32(0x28) != 0x00000000 and
      uint32(0x28) == uint32(0x2c) and
      uint32(uint32(0x3c) ^ uint32(0x28)) ^ uint32(0x28) == 0x00004550
}
YARA Detection Rule: MAL_Floxif_Generic
Repository: Neo23x0/signature-base
Detects: Detects Floxif Malware
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and (
         pe.imphash() == "2f4ddcfebbcad3bacadc879747151f6f" or
         pe.exports("FloodFix") or pe.exports("FloodFix2")
      )

Full rule:
rule MAL_Floxif_Generic {
   meta:
      description = "Detects Floxif Malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2018-05-11"
      score = 80
      hash1 = "de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085"
      id = "5ddd6a6c-b02a-518b-bbe3-8f528b3d7eae"
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and (
         pe.imphash() == "2f4ddcfebbcad3bacadc879747151f6f" or
         pe.exports("FloodFix") or pe.exports("FloodFix2")
      )
}
YARA Detection Rule: MAL_CN_FlyStudio_May18_1
Repository: Neo23x0/signature-base
Detects: Detects malware / hacktool detected in May 2018
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "WTNE / MADE BY E COMPILER - WUTAO " fullword ascii
      $s2 = "www.cfyhack.cn" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 5000KB and (
         pe.imphash() == "65ae5cf17140aeaf91e3e9911da0ee3e" or
         1 of them
      )

Full rule:
rule MAL_CN_FlyStudio_May18_1 {
   meta:
      description = "Detects malware / hacktool detected in May 2018"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2018-05-11"
      hash1 = "b[PII_REDACTED]0598518d4f277d44506eef871fd7fc6050d8f8e68889cae066d9e"
      id = "b78b9ea0-5eef-5922-b5d7-d3c5ddce7fad"
   strings:
      $s1 = "WTNE / MADE BY E COMPILER - WUTAO " fullword ascii
      $s2 = "www.cfyhack.cn" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 5000KB and (
         pe.imphash() == "65ae5cf17140aeaf91e3e9911da0ee3e" or
         1 of them
      )
}
YARA Detection Rule: MAL_Envrial_Jan18_1
Repository: Neo23x0/signature-base
Detects: Detects Encrial credential stealer malware
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/malwrhunterteam/status/[PII_REDACTED]29853184

Pattern signatures:
$x1 = "/Evrial/master/domen" wide

      $a1 = "\\Opera Software\\Opera Stable\\Login Data" wide
      $a2 = "\\Comodo\\Dragon\\User Data\\Default\\Login Data" wide
      $a3 = "\\Google\\Chrome\\User Data\\Default\\Login Data" wide
      $a4 = "\\Orbitum\\User Data\\Default\\Login Data" wide
      $a5 = "\\Kometa\\User Data\\Default\\Login Data" wide

      $s1 = "dlhosta.exe" fullword wide
      $s2 = "\\passwords.log" wide
      $s3 = "{{ <>h__TransparentIdentifier1 = {0}, Password = {1} }}" fullword wide
      $s4 = "files/upload.php?user={0}&hwid={1}" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 900KB and (
        1 of ($x*) or
        3 of them or
        2 of ($s*)
      )

Full rule:
rule MAL_Envrial_Jan18_1 {
   meta:
      description = "Detects Encrial credential stealer malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/malwrhunterteam/status/[PII_REDACTED]29853184"
      date = "2018-01-21"
      hash1 = "9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85"
      hash2 = "9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d"
      id = "8be5f0d8-013f-5070-9e19-9ac522c88693"
   strings:
      $x1 = "/Evrial/master/domen" wide

      $a1 = "\\Opera Software\\Opera Stable\\Login Data" wide
      $a2 = "\\Comodo\\Dragon\\User Data\\Default\\Login Data" wide
      $a3 = "\\Google\\Chrome\\User Data\\Default\\Login Data" wide
      $a4 = "\\Orbitum\\User Data\\Default\\Login Data" wide
      $a5 = "\\Kometa\\User Data\\Default\\Login Data" wide

      $s1 = "dlhosta.exe" fullword wide
      $s2 = "\\passwords.log" wide
      $s3 = "{{ <>h__TransparentIdentifier1 = {0}, Password = {1} }}" fullword wide
      $s4 = "files/upload.php?user={0}&hwid={1}" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 900KB and (
        1 of ($x*) or
        3 of them or
        2 of ($s*)
      )
}
YARA Detection Rule: CobaltStrike_C2_Host_Indicator
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike C2 host artifacts
Author: yara@s3c.za.net

Pattern signatures:
$c2_indicator_fp = "#Host: %s"
		$c2_indicator = "#Host:"

Detection condition:
$c2_indicator and not $c2_indicator_fp
		and not uint32(0) == 0x0a786564
		and not uint32(0) == 0x0a796564

Full rule:
rule CobaltStrike_C2_Host_Indicator {
	meta:
		description = "Detects CobaltStrike C2 host artifacts"
		author = "yara@s3c.za.net"
		date = "2019-08-16"
		id = "7f15ee30-664e-59b8-9e31-35d88e58a45e"
	strings:
		$c2_indicator_fp = "#Host: %s"
		$c2_indicator = "#Host:"
	condition:
		$c2_indicator and not $c2_indicator_fp
		and not uint32(0) == 0x0a786564
		and not uint32(0) == 0x0a796564
}
YARA Detection Rule: CobaltStrike_Sleep_Decoder_Indicator
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike sleep_mask decoder
Author: yara@s3c.za.net

Pattern signatures:
$sleep_decoder = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 4C 8B 51 08 41 8B F0 48 8B EA 48 8B D9 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 }

Detection condition:
$sleep_decoder

Full rule:
rule CobaltStrike_Sleep_Decoder_Indicator {
	meta:
		description = "Detects CobaltStrike sleep_mask decoder"
		author = "yara@s3c.za.net"
		date = "2021-07-19"
		id = "d5b53d68-55f9-5837-9b0c-e7be2f3bd072"
	strings:
		$sleep_decoder = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 4C 8B 51 08 41 8B F0 48 8B EA 48 8B D9 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 }
	condition:
		$sleep_decoder
}
YARA Detection Rule: CobaltStrike_MZ_Launcher
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike MZ header ReflectiveLoader launcher
Author: yara@s3c.za.net

Pattern signatures:
$mz_launcher = { 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D }

Detection condition:
$mz_launcher

Full rule:
rule CobaltStrike_MZ_Launcher {
	meta:
		description = "Detects CobaltStrike MZ header ReflectiveLoader launcher"
		author = "yara@s3c.za.net"
		date = "2021-07-08"
		id = "461a4741-11c5-53d9-b8e1-52d64cfe755b"
    strings:
        $mz_launcher = { 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D }
	condition:
		$mz_launcher
}
YARA Detection Rule: CobaltStrike_Unmodifed_Beacon
Repository: Neo23x0/signature-base
Detects: Detects unmodified CobaltStrike beacon DLL
Author: yara@s3c.za.net

Pattern signatures:
$loader_export = "ReflectiveLoader"
		$exportname = "beacon.dll"

Detection condition:
all of them

Full rule:
rule CobaltStrike_Unmodifed_Beacon {
	meta:
		description = "Detects unmodified CobaltStrike beacon DLL"
		author = "yara@s3c.za.net"
		date = "2019-08-16"
		id = "8eeb03f9-9698-5a46-b45b-224d5c3f3df7"
	strings:
		$loader_export = "ReflectiveLoader"
		$exportname = "beacon.dll"
	condition:
		all of them
}
YARA Detection Rule: APT_MAL_REvil_Kaseya_Jul21_1
Repository: Neo23x0/signature-base
Detects: Detects malware used in the Kaseya supply chain attack
Author: Florian Roth (Nextron Systems)
Reference: https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b

Pattern signatures:
$s1 = "Mpsvc.dll" wide fullword
      $s2 = ":0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:H<L<P<\\<`<" ascii fullword

      $op1 = { 40 87 01 c3 6a 08 68 f8 0e 41 00 e8 ae db ff ff be 80 25 41 00 39 35 ?? 32 41 00 }
      $op2 = { 8b 40 04 2b c2 c1 f8 02 3b c8 0f 84 56 ff ff ff 68 15 50 40 00 2b c1 6a 04 }
      $op3 = { 74 73 db e2 e8 ad 07 00 00 68 60 1a 40 00 e8 8f 04 00 00 e8 3a 05 00 00 50 e8 25 26 00 00 }
      $op4 = { 75 05 8b 45 fc eb 4c c7 45 f8 00 00 00 00 6a 00 8d 45 f0 50 8b 4d 0c }
      $op5 = { 83 7d 0c 00 75 05 8b 45 fc eb 76 6a 00 68 80 00 00 00 6a 01 6a 00 }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 3000KB and
      (
         pe.imphash() == "c36dcd2277c4a707a1a645d0f727542a" or
         2 of them
      )

Full rule:
rule APT_MAL_REvil_Kaseya_Jul21_1 {
   meta:
      description = "Detects malware used in the Kaseya supply chain attack"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b"
      date = "2021-07-02"
      hash1 = "1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e"
      hash2 = "aae6e388e774180bc3eb96dad5d5bfefd63d0eb7124d68b[PII_REDACTED]801f1c7"
      hash3 = "dc6b0e8c1e9c113f0364e1c8370060dee3fcbe25b667ddeca7623a95cd21411f"
      hash4 = "df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e"
      id = "7356f4ea-183f-52ec-a167-fc16b8bfb55a"
   strings:
      $s1 = "Mpsvc.dll" wide fullword
      $s2 = ":0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:H<L<P<\\<`<" ascii fullword

      $op1 = { 40 87 01 c3 6a 08 68 f8 0e 41 00 e8 ae db ff ff be 80 25 41 00 39 35 ?? 32 41 00 }
      $op2 = { 8b 40 04 2b c2 c1 f8 02 3b c8 0f 84 56 ff ff ff 68 15 50 40 00 2b c1 6a 04 }
      $op3 = { 74 73 db e2 e8 ad 07 00 00 68 60 1a 40 00 e8 8f 04 00 00 e8 3a 05 00 00 50 e8 25 26 00 00 }
      $op4 = { 75 05 8b 45 fc eb 4c c7 45 f8 00 00 00 00 6a 00 8d 45 f0 50 8b 4d 0c }
      $op5 = { 83 7d 0c 00 75 05 8b 45 fc eb 76 6a 00 68 80 00 00 00 6a 01 6a 00 }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 3000KB and
      (
         pe.imphash() == "c36dcd2277c4a707a1a645d0f727542a" or
         2 of them
      )
}
YARA Detection Rule: APT_MAL_REvil_Kaseya_Jul21_2
Repository: Neo23x0/signature-base
Detects: Detects malware used in the Kaseya supply chain attack
Author: Florian Roth (Nextron Systems)
Reference: https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b

Pattern signatures:
$opa1 = { 8b 4d fc 83 c1 01 89 4d fc 81 7d f0 ff 00 00 00 77 1? ba 01 00 00 00 6b c2 00 8b 4d 08 }
      $opa2 = { 89 45 f0 8b 4d fc 83 c1 01 89 4d fc 81 7d f0 ff 00 00 00 77 1? ba 01 00 00 00 6b c2 00 }
      $opa3 = { 83 c1 01 89 4d fc 81 7d f0 ff 00 00 00 77 1? ba 01 00 00 00 6b c2 00 8b 4d 08 0f b6 14 01 }
      $opa4 = { 89 45 f4 8b 0d ?? ?0 07 10 89 4d f8 8b 15 ?? ?1 07 10 89 55 fc ff 75 fc ff 75 f8 ff 55 f4 }

      $opb1 = { 18 00 10 bd 18 00 10 bd 18 00 10 0e 19 00 10 cc cc cc }
      $opb2 = { 18 00 10 0e 19 00 10 cc cc cc cc 8b 44 24 04 }
      $opb3 = { 10 c4 18 00 10 bd 18 00 10 bd 18 00 10 0e 19 00 10 cc cc }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 3000KB and ( 2 of ($opa*) or 3 of them )

Full rule:
rule APT_MAL_REvil_Kaseya_Jul21_2 {
   meta:
      description = "Detects malware used in the Kaseya supply chain attack"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b"
      date = "2021-07-02"
      hash1 = "0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402"
      hash2 = "8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd"
      hash3 = "cc0cdc6a3d843e22c98170713abf1d6ae06e8b5e34ed06ac3159adafe85e3bd6"
      hash4 = "d5ce6f36a06b0dc8ce8e7e2c9a53e66094c2adfc93cfac61dd09efe9ac45a75f"
      hash5 = "d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20"
      hash6 = "e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2"
      id = "38b168d4-e761-544e-9859-eb155bbfe54a"
   strings:
      $opa1 = { 8b 4d fc 83 c1 01 89 4d fc 81 7d f0 ff 00 00 00 77 1? ba 01 00 00 00 6b c2 00 8b 4d 08 }
      $opa2 = { 89 45 f0 8b 4d fc 83 c1 01 89 4d fc 81 7d f0 ff 00 00 00 77 1? ba 01 00 00 00 6b c2 00 }
      $opa3 = { 83 c1 01 89 4d fc 81 7d f0 ff 00 00 00 77 1? ba 01 00 00 00 6b c2 00 8b 4d 08 0f b6 14 01 }
      $opa4 = { 89 45 f4 8b 0d ?? ?0 07 10 89 4d f8 8b 15 ?? ?1 07 10 89 55 fc ff 75 fc ff 75 f8 ff 55 f4 }

      $opb1 = { 18 00 10 bd 18 00 10 bd 18 00 10 0e 19 00 10 cc cc cc }
      $opb2 = { 18 00 10 0e 19 00 10 cc cc cc cc 8b 44 24 04 }
      $opb3 = { 10 c4 18 00 10 bd 18 00 10 bd 18 00 10 0e 19 00 10 cc cc }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 3000KB and ( 2 of ($opa*) or 3 of them )
}
YARA Detection Rule: Quasar_RAT_1
Repository: Neo23x0/signature-base
Detects: Detects Quasar RAT
Author: Florian Roth (Nextron Systems)
Reference: https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

Pattern signatures:
$s1 = "DoUploadAndExecute" fullword ascii
      $s2 = "DoDownloadAndExecute" fullword ascii
      $s3 = "DoShellExecute" fullword ascii
      $s4 = "set_Processname" fullword ascii

      $op1 = { 04 1e fe 02 04 16 fe 01 60 }
      $op2 = { 00 17 03 1f 20 17 19 15 28 }
      $op3 = { 00 04 03 69 91 1b 40 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 5000KB and all of ($s*) or all of ($op*) )

Full rule:
rule Quasar_RAT_1 {
   meta:
      description = "Detects Quasar RAT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
      date = "2017-04-07"
      hash1 = "0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740"
      hash2 = "1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec"
      hash3 = "515c1a[PII_REDACTED]5af11d818192f7866ef6a2018aa13112fefbe08395732e89"
      hash4 = "f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34"
      id = "36220de3-aa1a-5c34-adae-432d939c811e"
   strings:
      $s1 = "DoUploadAndExecute" fullword ascii
      $s2 = "DoDownloadAndExecute" fullword ascii
      $s3 = "DoShellExecute" fullword ascii
      $s4 = "set_Processname" fullword ascii

      $op1 = { 04 1e fe 02 04 16 fe 01 60 }
      $op2 = { 00 17 03 1f 20 17 19 15 28 }
      $op3 = { 00 04 03 69 91 1b 40 }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 5000KB and all of ($s*) or all of ($op*) )
}
YARA Detection Rule: Quasar_RAT_2
Repository: Neo23x0/signature-base
Detects: Detects Quasar RAT
Author: Florian Roth (Nextron Systems)
Reference: https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

Pattern signatures:
$x1 = "GetKeyloggerLogsResponse" fullword ascii
      $x2 = "get_Keylogger" fullword ascii
      $x3 = "HandleGetKeyloggerLogsResponse" fullword ascii

      $s1 = "DoShellExecuteResponse" fullword ascii
      $s2 = "GetPasswordsResponse" fullword ascii
      $s3 = "GetStartupItemsResponse" fullword ascii
      $s4 = "<GetGenReader>b__7" fullword ascii
      $s5 = "RunHidden" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 5000KB and $x1 ) or ( all of them )

Full rule:
rule Quasar_RAT_2 {
   meta:
      description = "Detects Quasar RAT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
      date = "2017-04-07"
      super_rule = 1
      hash1 = "0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740"
      hash2 = "515c1a[PII_REDACTED]5af11d818192f7866ef6a2018aa13112fefbe08395732e89"
      hash3 = "f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34"
      id = "0ca795c5-3631-5a99-8[PII_REDACTED]5f478"
   strings:
      $x1 = "GetKeyloggerLogsResponse" fullword ascii
      $x2 = "get_Keylogger" fullword ascii
      $x3 = "HandleGetKeyloggerLogsResponse" fullword ascii

      $s1 = "DoShellExecuteResponse" fullword ascii
      $s2 = "GetPasswordsResponse" fullword ascii
      $s3 = "GetStartupItemsResponse" fullword ascii
      $s4 = "<GetGenReader>b__7" fullword ascii
      $s5 = "RunHidden" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 5000KB and $x1 ) or ( all of them )
}
YARA Detection Rule: MAL_QuasarRAT_May19_1
Repository: Neo23x0/signature-base
Detects: Detects QuasarRAT malware
Author: Florian Roth (Nextron Systems)
Reference: https://blog.ensilo.com/uncovering-new-activity-by-apt10

Pattern signatures:
$x1 = "Quasar.Common.Messages" ascii fullword
      $x2 = "Client.MimikatzTools" ascii fullword
      $x3 = "Resources.powerkatz_x86.dll" ascii fullword
      $x4 = "Uninstalling... good bye :-(" wide

      $xc1 = { 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00
               68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00
               63 00 72 00 65 00 61 00 74 00 65 00 20 00 2F 00
               74 00 6E 00 20 00 22 00 00 27 22 00 20 00 2F 00
               73 }
      $xc2 = { 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20
               00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C
               00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E
               00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20
               00 2F 00 61 00 20 00 2F 00 71 00 20 00 2F 00 66
               00 20 00 }

Detection condition:
uint16(0) == 0x5a4d and filesize < 10000KB and 1 of them

Full rule:
rule MAL_QuasarRAT_May19_1 {
   meta:
      description = "Detects QuasarRAT malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://blog.ensilo.com/uncovering-new-activity-by-apt10"
      date = "2019-05-27"
      modified = "2023-01-06"
      hash1 = "0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded"
      id = "a4e82b6a-31f8-59fc-acfa-805c4594680a"
   strings:
      $x1 = "Quasar.Common.Messages" ascii fullword
      $x2 = "Client.MimikatzTools" ascii fullword
      $x3 = "Resources.powerkatz_x86.dll" ascii fullword
      $x4 = "Uninstalling... good bye :-(" wide

      $xc1 = { 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00
               68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00
               63 00 72 00 65 00 61 00 74 00 65 00 20 00 2F 00
               74 00 6E 00 20 00 22 00 00 27 22 00 20 00 2F 00
               73 }
      $xc2 = { 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20
               00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C
               00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E
               00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20
               00 2F 00 61 00 20 00 2F 00 71 00 20 00 2F 00 66
               00 20 00 }
   condition:
      uint16(0) == 0x5a4d and filesize < 10000KB and 1 of them
}
YARA Detection Rule: MAL_LiteLLM_SupplyChain_Mar26
Repository: Neo23x0/signature-base
Detects: Detects malicious indicators used in LiteLLM supply chain attack
Author: Marius Benthin
Reference: https://github.com/BerriAI/litellm/issues/24512

Pattern signatures:
$s1 = "exec(base64.b64decode("
      $s2 = "litellm." base64
      $s3 = "subprocess.DEVNULL"

Detection condition:
filesize < 500KB
      and all of them

Full rule:
rule MAL_LiteLLM_SupplyChain_Mar26 {
   meta:
      description = "Detects malicious indicators used in LiteLLM supply chain attack"
      author = "Marius Benthin"
      date = "2026-03-28"
      reference = "https://github.com/BerriAI/litellm/issues/24512"
      hash = "71e35aef03099cd1f2d[PII_REDACTED]025a163597de93912df321ef118bf135238"
      score = 80
   strings:
      $s1 = "exec(base64.b64decode("
      $s2 = "litellm." base64
      $s3 = "subprocess.DEVNULL"
   condition:
      filesize < 500KB
      and all of them
}
YARA Detection Rule: MAL_Telnyx_SupplyChain_Mar26
Repository: Neo23x0/signature-base
Detects: Detects malicious indicators used in Telnyx supply chain attack
Author: Marius Benthin
Reference: https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm

Pattern signatures:
$s1 = "bXNidWlsZC5leGU="  // msbuild.exe
      $s2 = "TW96aWxsY"  // Mozilla/
      $s3 = ".getnframes("  // number of WAV audio frames
      $s4 = "exec(base64.b64decode("

Detection condition:
filesize < 500KB
      and 3 of them

Full rule:
rule MAL_Telnyx_SupplyChain_Mar26 {
   meta:
      description = "Detects malicious indicators used in Telnyx supply chain attack"
      author = "Marius Benthin"
      date = "2026-03-28"
      reference = "https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm"
      hash = "ab4c4aebb52027bf3d2f6b2dcef593a1a2cff415774ea4711f7d6e0aa1451d4e"
      score = 80
   strings:
      $s1 = "bXNidWlsZC5leGU="  // msbuild.exe
      $s2 = "TW96aWxsY"  // Mozilla/
      $s3 = ".getnframes("  // number of WAV audio frames
      $s4 = "exec(base64.b64decode("
   condition:
      filesize < 500KB
      and 3 of them
}
YARA Detection Rule: MAL_Github_Repo_Compromise_MyJino_Ru_Aug22
Repository: Neo23x0/signature-base
Detects: Detects URL mentioned in report on compromised Github repositories in August 2022
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/stephenlacy/status/[PII_REDACTED]30505473

Pattern signatures:
$x1 = "curl http://ovz1.j19544519.pr46m.vps.myjino.ru" ascii wide
      $x2 = "http__.Post(\"http://ovz1.j19544519.pr46m.vps.myjino.ru" ascii wide

Detection condition:
1 of them

Full rule:
rule MAL_Github_Repo_Compromise_MyJino_Ru_Aug22 {
   meta:
      description = "Detects URL mentioned in report on compromised Github repositories in August 2022"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/stephenlacy/status/[PII_REDACTED]30505473"
      date = "2022-08-03"
      score = 90
      id = "1eaabad5-d0de-5d17-a5fa-3c638354843d"
   strings:
      $x1 = "curl http://ovz1.j19544519.pr46m.vps.myjino.ru" ascii wide
      $x2 = "http__.Post(\"http://ovz1.j19544519.pr46m.vps.myjino.ru" ascii wide
   condition:
      1 of them
}