deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EQGRP_Implants_Gen3
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - from files BARPUNCH-3110, BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120, BPICKER-3100
Author: Florian Roth
Reference: Research

Pattern signatures:
$x1 = "incomplete and must be removed manually.)" fullword ascii
        $s1 = "%s: recv'd an error from the target." fullword ascii
        $s2 = "Unable to fetch the address to the get_uptime_secs function for this OS version" fullword ascii
        $s3 = "upload/activate/de-activate/remove/cmd function failed" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 6000KB and 2 of them ) or ( all of them )

Full rule:
rule EQGRP_Implants_Gen3 
{

    meta:
        description = "EQGRP Toolset Firewall - from files BARPUNCH-3110, BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120, BPICKER-3100"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        super_rule = 1
        hash1 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
        hash2 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
        hash3 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f[PII_REDACTED]3c1a7939"
        hash4 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
        hash5 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
        hash6 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"

    strings:
        $x1 = "incomplete and must be removed manually.)" fullword ascii
        $s1 = "%s: recv'd an error from the target." fullword ascii
        $s2 = "Unable to fetch the address to the get_uptime_secs function for this OS version" fullword ascii
        $s3 = "upload/activate/de-activate/remove/cmd function failed" fullword ascii

    condition:
        ( uint16(0) == 0x457f and filesize < 6000KB and 2 of them ) or ( all of them )
}
YARA Detection Rule: EQGRP_BLIAR_BLIQUER
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - from files BLIAR-2110, BLIQUER-2230
Author: Florian Roth
Reference: Research

Pattern signatures:
$x1 = "Do you wish to activate the implant that is already on the firewall? (y/n): " fullword ascii
        $x2 = "There is no implant present on the firewall." fullword ascii
        $x3 = "Implant Version :%lx%lx%lx" fullword ascii
        $x4 = "You may now connect to the implant using the pbd idkey" fullword ascii
        $x5 = "No reply from persistant back door." fullword ascii
        $x6 = "rm -rf pbd.wc; wc -c %s > pbd.wc" fullword ascii
        $p1 = "PBD_GetVersion" fullword ascii
        $p2 = "pbd/pbdEncrypt.bin" fullword ascii
        $p3 = "pbd/pbdGetVersion.pkt" fullword ascii
        $p4 = "pbd/pbdStartWrite.bin" fullword ascii
        $p5 = "pbd/pbd_setNewHookPt.pkt" fullword ascii
        $p6 = "pbd/pbd_Upload_SinglePkt.pkt" fullword ascii
        $s1 = "Unable to fetch hook and jmp addresses for this OS version" fullword ascii
        $s2 = "Could not get hook and jump addresses" fullword ascii
        $s3 = "Enter the name of a clean implant binary (NOT an image):"

Detection condition:
( uint16(0) == 0x457f and filesize < 3000KB and ( 1 of ($x*) or 1 of ($p*) ) ) or ( 3 of them )

Full rule:
rule EQGRP_BLIAR_BLIQUER 
{

    meta:
        description = "EQGRP Toolset Firewall - from files BLIAR-2110, BLIQUER-2230"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        super_rule = 1
        hash1 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
        hash2 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f[PII_REDACTED]3c1a7939"

    strings:
        $x1 = "Do you wish to activate the implant that is already on the firewall? (y/n): " fullword ascii
        $x2 = "There is no implant present on the firewall." fullword ascii
        $x3 = "Implant Version :%lx%lx%lx" fullword ascii
        $x4 = "You may now connect to the implant using the pbd idkey" fullword ascii
        $x5 = "No reply from persistant back door." fullword ascii
        $x6 = "rm -rf pbd.wc; wc -c %s > pbd.wc" fullword ascii
        $p1 = "PBD_GetVersion" fullword ascii
        $p2 = "pbd/pbdEncrypt.bin" fullword ascii
        $p3 = "pbd/pbdGetVersion.pkt" fullword ascii
        $p4 = "pbd/pbdStartWrite.bin" fullword ascii
        $p5 = "pbd/pbd_setNewHookPt.pkt" fullword ascii
        $p6 = "pbd/pbd_Upload_SinglePkt.pkt" fullword ascii
        $s1 = "Unable to fetch hook and jmp addresses for this OS version" fullword ascii
        $s2 = "Could not get hook and jump addresses" fullword ascii
        $s3 = "Enter the name of a clean implant binary (NOT an image):" fullword ascii
        $s4 = "Unable to read dat file for OS version 0x%08lx" fullword ascii
        $s5 = "Invalid implant file" fullword ascii

    condition:
        ( uint16(0) == 0x457f and filesize < 3000KB and ( 1 of ($x*) or 1 of ($p*) ) ) or ( 3 of them )
}
YARA Detection Rule: EQGRP_sploit
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - from files sploit.py, sploit.py
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "print \"[+] Connecting to %s:%s\" % (self.params.dst['ip'], self.params.dst['port'])" fullword ascii
        $s2 = "@overridable(\"Must be overriden if the target will be touched.  Base implementation should not be called.\")" fullword ascii
        $s3 = "@overridable(\"Must be overriden.  Base implementation should not be called.\")" fullword ascii
        $s4 = "exp.load_vinfo()" fullword ascii
        $s5 = "if not okay and self.terminateFlingOnException:" fullword ascii
        $s6 = "print \"[-] keyboard interrupt before response received\"" fullword ascii
        $s7 = "if self.terminateFlingOnException:" fullword ascii
        $s8 = "print 'Debug info ','='*40" fullword ascii

Detection condition:
( uint16(0) == 0x2123 and filesize < 90KB and 1 of ($s*) ) or ( 4 of them )

Full rule:
rule EQGRP_sploit 
{

    meta:
        description = "EQGRP Toolset Firewall - from files sploit.py, sploit.py"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        super_rule = 1
        hash1 = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"
        hash2 = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"

    strings:
        $s1 = "print \"[+] Connecting to %s:%s\" % (self.params.dst['ip'], self.params.dst['port'])" fullword ascii
        $s2 = "@overridable(\"Must be overriden if the target will be touched.  Base implementation should not be called.\")" fullword ascii
        $s3 = "@overridable(\"Must be overriden.  Base implementation should not be called.\")" fullword ascii
        $s4 = "exp.load_vinfo()" fullword ascii
        $s5 = "if not okay and self.terminateFlingOnException:" fullword ascii
        $s6 = "print \"[-] keyboard interrupt before response received\"" fullword ascii
        $s7 = "if self.terminateFlingOnException:" fullword ascii
        $s8 = "print 'Debug info ','='*40" fullword ascii

    condition:
        ( uint16(0) == 0x2123 and filesize < 90KB and 1 of ($s*) ) or ( 4 of them )
}
YARA Detection Rule: EQGRP_Implants_Gen1
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - from files BananaUsurper-2120, BARPUNCH-3110, BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120, BPICKER-3100, lpexe, writeJetPlow-2130
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "WARNING:  Session may not have been closed!" fullword ascii
        $s2 = "EXEC Packet Processed" fullword ascii
        $s3 = "Failed to insert the command into command list." fullword ascii
        $s4 = "Send_Packet: Trying to send too much data." fullword ascii
        $s5 = "payloadLength >= MAX_ALLOW_SIZE." fullword ascii
        $s6 = "Wrong Payload Size" fullword ascii
        $s7 = "Unknown packet received......" fullword ascii
        $s8 = "Returned eax = %08x" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 6000KB and ( 2 of ($s*) ) ) or ( 5 of them )

Full rule:
rule EQGRP_Implants_Gen1 
{

    meta:
        description = "EQGRP Toolset Firewall - from files BananaUsurper-2120, BARPUNCH-3110, BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120, BPICKER-3100, lpexe, writeJetPlow-2130"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        super_rule = 1
        hash1 = "3366b4bbf265716869a487203a8ac[PII_REDACTED]0990493dd4dd8385e42b0c119"
        hash2 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
        hash3 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
        hash4 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f[PII_REDACTED]3c1a7939"
        hash5 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
        hash6 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
        hash7 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
        hash8 = "ee3e3487a[PII_REDACTED]e27b4078c5a3cb47bb31fc607634468cc67753f7e61d7"
        hash9 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
   
    strings:
        $s1 = "WARNING:  Session may not have been closed!" fullword ascii
        $s2 = "EXEC Packet Processed" fullword ascii
        $s3 = "Failed to insert the command into command list." fullword ascii
        $s4 = "Send_Packet: Trying to send too much data." fullword ascii
        $s5 = "payloadLength >= MAX_ALLOW_SIZE." fullword ascii
        $s6 = "Wrong Payload Size" fullword ascii
        $s7 = "Unknown packet received......" fullword ascii
        $s8 = "Returned eax = %08x" fullword ascii
    
    condition:
        ( uint16(0) == 0x457f and filesize < 6000KB and ( 2 of ($s*) ) ) or ( 5 of them )
}
YARA Detection Rule: EQGRP_eligiblebombshell_generic
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - from files eligiblebombshell_1.2.0.1.py, eligiblebombshell_1.2.0.1.py
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "logging.error(\"       Perhaps you should run with --scan?\")" fullword ascii
        $s2 = "logging.error(\"ERROR: No entry for ETag [%s] in %s.\" %" fullword ascii
        $s3 = "\"be supplied\")" fullword ascii

Detection condition:
( filesize < 70KB and 2 of ($s*) ) or ( all of them )

Full rule:
rule EQGRP_eligiblebombshell_generic 
{

    meta:
        description = "EQGRP Toolset Firewall - from files eligiblebombshell_1.2.0.1.py, eligiblebombshell_1.2.0.1.py"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        super_rule = 1
        hash1 = "dd0e3ae6e1039a755bf6cb28bf726b4d6ab4a1da2392ba66d114a43a55491eb1"
        hash2 = "dd0e3ae6e1039a755bf6cb28bf726b4d6ab4a1da2392ba66d114a43a55491eb1"
  
    strings:
        $s1 = "logging.error(\"       Perhaps you should run with --scan?\")" fullword ascii
        $s2 = "logging.error(\"ERROR: No entry for ETag [%s] in %s.\" %" fullword ascii
        $s3 = "\"be supplied\")" fullword ascii
  
    condition:
        ( filesize < 70KB and 2 of ($s*) ) or ( all of them )
}
YARA Detection Rule: EQGRP_ssh_telnet_29
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - from files ssh.py, telnet.py
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "received prompt, we're in" fullword ascii
        $s2 = "failed to login, bad creds, abort" fullword ascii
        $s3 = "sending command \" + str(n) + \"/\" + str(tot) + \", len \" + str(len(chunk) + " fullword ascii
        $s4 = "received nat - EPBA: ok, payload: mangled, did not run" fullword ascii
        $s5 = "no status returned from target, could be an exploit failure, or this is a version where we don't expect a stus return" ascii
        $s6 = "received arp - EPBA: ok, payload: fail" fullword ascii
        $s7 = "chopped = string.rstrip(payload, \"\\x0a\")" fullword ascii

Detection condition:
( filesize < 10KB and 2 of them ) or ( 3 of them )

Full rule:
rule EQGRP_ssh_telnet_29 
{

    meta:
        description = "EQGRP Toolset Firewall - from files ssh.py, telnet.py"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        super_rule = 1
        hash1 = "630d464b1d08c4dfd0bd50552bee2d6a591fb0b5597ecebaa556a3c3d4e0aa4e"
        hash2 = "07f4c60505f4d5fb5c4a76a8c899d9b63291444a3980d94c06e1d5889ae85482"
    
    strings:
        $s1 = "received prompt, we're in" fullword ascii
        $s2 = "failed to login, bad creds, abort" fullword ascii
        $s3 = "sending command \" + str(n) + \"/\" + str(tot) + \", len \" + str(len(chunk) + " fullword ascii
        $s4 = "received nat - EPBA: ok, payload: mangled, did not run" fullword ascii
        $s5 = "no status returned from target, could be an exploit failure, or this is a version where we don't expect a stus return" ascii
        $s6 = "received arp - EPBA: ok, payload: fail" fullword ascii
        $s7 = "chopped = string.rstrip(payload, \"\\x0a\")" fullword ascii
   
    condition:
        ( filesize < 10KB and 2 of them ) or ( 3 of them )
}
YARA Detection Rule: EQGRP_tinyexec
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - from files tinyexec
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = { 73 68 73 74 72 74 61 62 00 2E 74 65 78 74 }
        $s2 = { 5A 58 55 52 89 E2 55 50 89 E1 }

Detection condition:
uint32(0) == 0x464c457f and filesize < 270 and all of them

Full rule:
rule EQGRP_tinyexec 
{

    meta:
        description = "EQGRP Toolset Firewall - from files tinyexec"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"

    strings:
        $s1 = { 73 68 73 74 72 74 61 62 00 2E 74 65 78 74 }
        $s2 = { 5A 58 55 52 89 E2 55 50 89 E1 }

    condition:
        uint32(0) == 0x464c457f and filesize < 270 and all of them
}
YARA Detection Rule: EQGRP_callbacks
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - Callback addresses
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "30.40.50.60:9342" fullword ascii wide /* DoD */

Detection condition:
1 of them

Full rule:
rule EQGRP_callbacks 
{

    meta:
        description = "EQGRP Toolset Firewall - Callback addresses"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"

    strings:
        $s1 = "30.40.50.60:9342" fullword ascii wide /* DoD */
    
    condition:
        1 of them
}
YARA Detection Rule: EQGRP_Extrabacon_Output
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - Extrabacon exploit output
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "|###[ SNMPresponse ]###" fullword ascii
        $s2 = "[+] generating exploit for exec mode pass-disable" fullword ascii
        $s3 = "[+] building payload for mode pass-disable" fullword ascii
        $s4 = "[+] Executing:  extrabacon" fullword ascii
        $s5 = "appended AAAADMINAUTH_ENABLE payload" fullword ascii

Detection condition:
2 of them

Full rule:
rule EQGRP_Extrabacon_Output 
{

    meta:
        description = "EQGRP Toolset Firewall - Extrabacon exploit output"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"

    strings:
        $s1 = "|###[ SNMPresponse ]###" fullword ascii
        $s2 = "[+] generating exploit for exec mode pass-disable" fullword ascii
        $s3 = "[+] building payload for mode pass-disable" fullword ascii
        $s4 = "[+] Executing:  extrabacon" fullword ascii
        $s5 = "appended AAAADMINAUTH_ENABLE payload" fullword ascii
   
    condition:
        2 of them
}
YARA Detection Rule: EQGRP_Unique_Strings
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - Unique strings
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "/BananaGlee/ELIGIBLEBOMB" ascii
        $s2 = "Protocol must be either http or https (Ex: https://1.2.3.4:1234)"

Detection condition:
1 of them

Full rule:
rule EQGRP_Unique_Strings 
{

    meta:
        description = "EQGRP Toolset Firewall - Unique strings"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"

    strings:
        $s1 = "/BananaGlee/ELIGIBLEBOMB" ascii
        $s2 = "Protocol must be either http or https (Ex: https://1.2.3.4:1234)"

    condition:
        1 of them
}
YARA Detection Rule: EQGRP_RC5_RC6_Opcode
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - RC5 / RC6 opcode
Author: Florian Roth
Reference: https://securelist.com/blog/incidents/75812/the-equation-giveaway/

Pattern signatures:
/*
            mov     esi, [ecx+edx*4-4]
            sub     esi, 61C88647h
            mov     [ecx+edx*4], esi
            inc     edx
            cmp     edx, 2Bh
        */
        $s1 = { 8B 74 91 FC 81 EE 47 86 C8 61 89 34 91 42 83 FA 2B }

Detection condition:
1 of them

Full rule:
rule EQGRP_RC5_RC6_Opcode
{

    meta:
        description = "EQGRP Toolset Firewall - RC5 / RC6 opcode"
        author = "Florian Roth"
        reference = "https://securelist.com/blog/incidents/75812/the-equation-giveaway/"
        date = "2016-08-17"

    strings:
        /*
            mov     esi, [ecx+edx*4-4]
            sub     esi, 61C88647h
            mov     [ecx+edx*4], esi
            inc     edx
            cmp     edx, 2Bh
        */
        $s1 = { 8B 74 91 FC 81 EE 47 86 C8 61 89 34 91 42 83 FA 2B }
    
    condition:
        1 of them
}
YARA Detection Rule: yordanyan_activeagent
Repository: Yara-Rules/rules
Detects: Memory string yara for Yordanyan ActiveAgent
Author: J from THL <j@techhelplist.com>

Pattern signatures:
// the wide strings are 16bit bigendian strings in memory. strings -e b memdump.file
		$s01 = "I'm KeepRunner!" wide
		$s02 = "I'm Updater!" wide
		$s03 = "Starting Download..." wide
		$s04 = "Download Complete!" wide
		$s05 = "Running New Agent and terminating updater!" wide
		$s06 = "Can't Run downloaded file!" wide
		$s07 = "Retrying download and run!" wide
		$s08 = "Can't init Client." wide
		$s09 = "Client initialised -" wide
		$s10 = "Client not found!" wide
		$s11 = "Client signed." wide
		$s12 = "GetClientData" wide
		$s13 = "&counter=" wide
		$s14 = "&agent_file_version=" wide
		$s15 = "&agent_id=" wide
		$s16 = "mac_address=" wide
		$s17 = "Getting Attachments" wide
		$s18 = "public_name" wide
		$s19 = "Yor agent id =" wide
		$s20 = "Yor agent version =" wide
		$s21 = "Last agent version =" wide
		$s22 = "Agent is last version." wide
		$s23 = "Updating Agent" wide
		$s24 = "Terminating RunKeeper" wide
		$s25 = "Terminating RunKeeper: Done" wide
		$s26 = "ActiveAgent" ascii
		

Detection condition:
15 of them

Full rule:
rule yordanyan_activeagent {
	meta:
		description = "Memory string yara for Yordanyan ActiveAgent"
		author = "J from THL <j@techhelplist.com>"
		reference1 = "https://www.virustotal.com/#/file/a2e34bfd5a9789837bc2d580e87ec11b9f29c4a50296ef45b06e3895ff399746/detection"
		reference2 = "ETPRO TROJAN Win32.ActiveAgent CnC Create"
		date = "2018-10-04"
		maltype = "Botnet"
		filetype = "memory"

	strings:
		// the wide strings are 16bit bigendian strings in memory. strings -e b memdump.file
		$s01 = "I'm KeepRunner!" wide
		$s02 = "I'm Updater!" wide
		$s03 = "Starting Download..." wide
		$s04 = "Download Complete!" wide
		$s05 = "Running New Agent and terminating updater!" wide
		$s06 = "Can't Run downloaded file!" wide
		$s07 = "Retrying download and run!" wide
		$s08 = "Can't init Client." wide
		$s09 = "Client initialised -" wide
		$s10 = "Client not found!" wide
		$s11 = "Client signed." wide
		$s12 = "GetClientData" wide
		$s13 = "&counter=" wide
		$s14 = "&agent_file_version=" wide
		$s15 = "&agent_id=" wide
		$s16 = "mac_address=" wide
		$s17 = "Getting Attachments" wide
		$s18 = "public_name" wide
		$s19 = "Yor agent id =" wide
		$s20 = "Yor agent version =" wide
		$s21 = "Last agent version =" wide
		$s22 = "Agent is last version." wide
		$s23 = "Updating Agent" wide
		$s24 = "Terminating RunKeeper" wide
		$s25 = "Terminating RunKeeper: Done" wide
		$s26 = "ActiveAgent" ascii
		$s27 = "public_name" ascii

	condition:
		15 of them

}
YARA Detection Rule: viotto_keylogger
Repository: Yara-Rules/rules

Pattern signatures:
$hdr = "MZ"
	$s1 = "Viotto Keylogger"
	$s2 = "msvbvm60"
	$s3 = "FtpPutFileA"
	$s4 = "VBA6"
	$s5 = "SetWindowsHookExA"

Detection condition:
($hdr at 0) and all of ($s*)

Full rule:
rule viotto_keylogger
{
strings:
	$hdr = "MZ"
	$s1 = "Viotto Keylogger"
	$s2 = "msvbvm60"
	$s3 = "FtpPutFileA"
	$s4 = "VBA6"
	$s5 = "SetWindowsHookExA"
condition:
	($hdr at 0) and all of ($s*)

}
YARA Detection Rule: Empire_Invoke_MetasploitPayload
Repository: Yara-Rules/rules
Detects: Detects Empire component - file Invoke-MetasploitPayload.ps1
Author: Florian Roth
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$s1 = "$ProcessInfo.Arguments=\"-nop -c $DownloadCradle\"" fullword ascii
      $s2 = "$PowershellExe=$env:windir+'\\syswow64\\WindowsPowerShell\\v1.0\\powershell.exe'" fullword ascii

Detection condition:
( uint16(0) == 0x7566 and filesize < 9KB and 1 of them ) or all of them

Full rule:
rule Empire_Invoke_MetasploitPayload {
   meta:
      description = "Detects Empire component - file Invoke-MetasploitPayload.ps1"
      author = "Florian Roth"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "a85ca27537ebeb79601b885b35ddff6431860b5852c6a664d32a321782808c54"
   strings:
      $s1 = "$ProcessInfo.Arguments=\"-nop -c $DownloadCradle\"" fullword ascii
      $s2 = "$PowershellExe=$env:windir+'\\syswow64\\WindowsPowerShell\\v1.0\\powershell.exe'" fullword ascii
   condition:
      ( uint16(0) == 0x7566 and filesize < 9KB and 1 of them ) or all of them
}
YARA Detection Rule: Empire_Exploit_Jenkins
Repository: Yara-Rules/rules
Detects: Detects Empire component - file Exploit-Jenkins.ps1
Author: Florian Roth
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$s1 = "$postdata=\"script=println+new+ProcessBuilder%28%27\"+$($Cmd)+\"" ascii
      $s2 = "$url = \"http://\"+$($Rhost)+\":\"+$($Port)+\"/script\"" fullword ascii
      $s3 = "$Cmd = [System.Web.HttpUtility]::UrlEncode($Cmd)" fullword ascii

Detection condition:
( uint16(0) == 0x6620 and filesize < 7KB and 1 of them ) or all of them

Full rule:
rule Empire_Exploit_Jenkins {
   meta:
      description = "Detects Empire component - file Exploit-Jenkins.ps1"
      author = "Florian Roth"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "a5182cccd82bb9984b804b365e07baba78344108f225b94bd12a59081f680729"
   strings:
      $s1 = "$postdata=\"script=println+new+ProcessBuilder%28%27\"+$($Cmd)+\"" ascii
      $s2 = "$url = \"http://\"+$($Rhost)+\":\"+$($Port)+\"/script\"" fullword ascii
      $s3 = "$Cmd = [System.Web.HttpUtility]::UrlEncode($Cmd)" fullword ascii
   condition:
      ( uint16(0) == 0x6620 and filesize < 7KB and 1 of them ) or all of them
}
YARA Detection Rule: Empire_Get_SecurityPackages
Repository: Yara-Rules/rules
Detects: Detects Empire component - file Get-SecurityPackages.ps1
Author: Florian Roth
Reference: https://github.com/adaptivethreat/Empire

Pattern signatures:
$s1 = "$null = $EnumBuilder.DefineLiteral('LOGON', 0x2000)" fullword ascii
      $s2 = "$EnumBuilder = $ModuleBuilder.DefineEnum('SSPI.SECPKG_FLAG', 'Public', [Int32])" fullword ascii

Detection condition:
( uint16(0) == 0x7566 and filesize < 20KB and 1 of them ) or all of them

Full rule:
rule Empire_Get_SecurityPackages {
   meta:
      description = "Detects Empire component - file Get-SecurityPackages.ps1"
      author = "Florian Roth"
      reference = "https://github.com/adaptivethreat/Empire"
      date = "2016-11-05"
      hash1 = "5d06e99121cff9b0fce74b71a137501452eebbcd1e901b26bde858313ee5a9c1"
   strings:
      $s1 = "$null = $EnumBuilder.DefineLiteral('LOGON', 0x2000)" fullword ascii
      $s2 = "$EnumBuilder = $ModuleBuilder.DefineEnum('SSPI.SECPKG_FLAG', 'Public', [Int32])" fullword ascii
   condition:
      ( uint16(0) == 0x7566 and filesize < 20KB and 1 of them ) or all of them
}