deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: SUSP_Microsoft_RAR_SFX_Combo
Repository: Neo23x0/signature-base
Detects: Detects a suspicious file that has a Microsoft copyright and is a RAR SFX
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "winrarsfxmappingfile.tmp" fullword wide
      $s2 = "WinRAR self-extracting archive" fullword wide
      $s3 = "WINRAR.SFX" fullword

      /* PE Header : LegalCopyright (C) Microsoft Corporation. All rights reserved.*/
      $c1 = { 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70
              00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 A9
              00 20 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F
              00 66 00 74 00 20 00 43 00 6F 00 72 00 70 00 6F
              00 72 00 61 00 74 00 69 00 6F 00 6E 00 2E 00 20
              00 41 00 6C 00 6C 00 20 00 72 00 69 00 67 00 68
              00 74 00 73 00 20 00 72 00 65 00 73 00 65 00 72
              00 76 00 65 00 64 00 2E }

Detection condition:
uint16(0) == 0x5a4d and filesize < 3000KB and 1 of ($s*) and $c1

Full rule:
rule SUSP_Microsoft_RAR_SFX_Combo {
   meta:
      description = "Detects a suspicious file that has a Microsoft copyright and is a RAR SFX"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2018-09-16"
      id = "0fa81a9e-2f41-5783-9786-bb6d33b82bd9"
   strings:
      $s1 = "winrarsfxmappingfile.tmp" fullword wide
      $s2 = "WinRAR self-extracting archive" fullword wide
      $s3 = "WINRAR.SFX" fullword

      /* PE Header : LegalCopyright (C) Microsoft Corporation. All rights reserved.*/
      $c1 = { 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70
              00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 A9
              00 20 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F
              00 66 00 74 00 20 00 43 00 6F 00 72 00 70 00 6F
              00 72 00 61 00 74 00 69 00 6F 00 6E 00 2E 00 20
              00 41 00 6C 00 6C 00 20 00 72 00 69 00 67 00 68
              00 74 00 73 00 20 00 72 00 65 00 73 00 65 00 72
              00 76 00 65 00 64 00 2E }
   condition:
      uint16(0) == 0x5a4d and filesize < 3000KB and 1 of ($s*) and $c1
}
YARA Detection Rule: VULN_PUA_GIGABYTE_Driver_Jul22_1
Repository: Neo23x0/signature-base
Detects: Detects a vulnerable GIGABYTE driver sometimes used by malicious actors to escalate privileges
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/malmoeb/status/[PII_REDACTED]42786306

Pattern signatures:
$xc1 = { 00 46 00 69 00 6C 00 65 00 56 00 65 00 72 00 73
               00 69 00 6F 00 6E 00 00 00 00 00 35 00 2E 00 32
               00 2E 00 33 00 37 00 39 00 30 00 2E 00 31 00 38
               00 33 00 30 00 20 00 62 00 75 00 69 00 6C 00 74
               00 20 00 62 00 79 00 3A 00 20 00 57 00 69 00 6E
               00 44 00 44 00 4B 00 00 00 00 00 32 00 09 00 01
               00 49 00 6E 00 74 00 65 00 72 00 6E 00 61 00 6C
               00 4E 00 61 00 6D 00 65 00 00 00 67 00 64 00 72
               00 76 00 2E 00 73 00 79 00 73 }
      
      /* base64 encoded form */
      $x1 = "AEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAANQAuADIALgAzADcAOQAwAC4AMQA4ADMAMAAgAGIAdQBpAGwAdAAgAGIAeQA6ACAAVwBpAG4ARABEAEsAAAAAADIACQABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAAZwBkAHIAdgAuAHMAeQBz"
      $x2 = "BGAGkAbABlAFYAZQByAHMAaQBvAG4AAAAAADUALgAyAC4AMwA3ADkAMAAuADEAOAAzADAAIABiAHUAaQBsAHQAIABiAHkAOgAgAFcAaQBuAEQARABLAAAAAAAyAAkAAQBJAG4AdABlAHIAbgBhAGwATgBhAG0AZQAAAGcAZAByAHYALgBzAHkAc"
      $x3 = "ARgBpA

Detection condition:
filesize < 4000KB and 1 of them

Full rule:
rule VULN_PUA_GIGABYTE_Driver_Jul22_1 {
   meta:
      description = "Detects a vulnerable GIGABYTE driver sometimes used by malicious actors to escalate privileges"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/malmoeb/status/[PII_REDACTED]42786306"
      date = "2022-07-25"
      score = 65
      hash1 = "31f4cfb4c71da[PII_REDACTED]1103a16512444c13c2ac2d857a7e6f13cb679b427"
      id = "c66b858f-a034-53e1-b0fd-e48693fc6913"
   strings:
      $xc1 = { 00 46 00 69 00 6C 00 65 00 56 00 65 00 72 00 73
               00 69 00 6F 00 6E 00 00 00 00 00 35 00 2E 00 32
               00 2E 00 33 00 37 00 39 00 30 00 2E 00 31 00 38
               00 33 00 30 00 20 00 62 00 75 00 69 00 6C 00 74
               00 20 00 62 00 79 00 3A 00 20 00 57 00 69 00 6E
               00 44 00 44 00 4B 00 00 00 00 00 32 00 09 00 01
               00 49 00 6E 00 74 00 65 00 72 00 6E 00 61 00 6C
               00 4E 00 61 00 6D 00 65 00 00 00 67 00 64 00 72
               00 76 00 2E 00 73 00 79 00 73 }
      
      /* base64 encoded form */
      $x1 = "AEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAANQAuADIALgAzADcAOQAwAC4AMQA4ADMAMAAgAGIAdQBpAGwAdAAgAGIAeQA6ACAAVwBpAG4ARABEAEsAAAAAADIACQABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAAZwBkAHIAdgAuAHMAeQBz"
      $x2 = "BGAGkAbABlAFYAZQByAHMAaQBvAG4AAAAAADUALgAyAC4AMwA3ADkAMAAuADEAOAAzADAAIABiAHUAaQBsAHQAIABiAHkAOgAgAFcAaQBuAEQARABLAAAAAAAyAAkAAQBJAG4AdABlAHIAbgBhAGwATgBhAG0AZQAAAGcAZAByAHYALgBzAHkAc"
      $x3 = "ARgBpAGwAZQBWAGUAcgBzAGkAbwBuAAAAAAA1AC4AMgAuADMANwA5ADAALgAxADgAMwAwACAAYgB1AGkAbAB0ACAAYgB5ADoAIABXAGkAbgBEAEQASwAAAAAAMgAJAAEASQBuAHQAZQByAG4AYQBsAE4AYQBtAGUAAABnAGQAcgB2AC4AcwB5AH"
   condition:
      filesize < 4000KB and 1 of them
}
YARA Detection Rule: Acrotray_Anomaly
Repository: Neo23x0/signature-base
Detects: Detects an acrotray.exe that does not contain the usual strings
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "PDF/X-3:2002" fullword wide
      $s2 = "AcroTray - Adobe Acrobat Distiller helper application" fullword wide
      $s3 = "MS Sans Serif" fullword wide
      $s4 = "COOLTYPE.DLL" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 3000KB
      and (filename == "acrotray.exe" or filename == "AcroTray.exe")
      and not all of ($s*)

Full rule:
rule Acrotray_Anomaly {
   meta:
      description = "Detects an acrotray.exe that does not contain the usual strings"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      score = 75
      id = "e3fef644-e535-5137-ac98-2fd1b7ca4361"
   strings:
      $s1 = "PDF/X-3:2002" fullword wide
      $s2 = "AcroTray - Adobe Acrobat Distiller helper application" fullword wide
      $s3 = "MS Sans Serif" fullword wide
      $s4 = "COOLTYPE.DLL" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 3000KB
      and (filename == "acrotray.exe" or filename == "AcroTray.exe")
      and not all of ($s*)
}
YARA Detection Rule: COZY_FANCY_BEAR_modified_VmUpgradeHelper
Repository: Neo23x0/signature-base
Detects: Detects a malicious VmUpgradeHelper.exe as mentioned in the CrowdStrike report
Author: Florian Roth (Nextron Systems)
Reference: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/

Pattern signatures:
$s1 = "VMware, Inc." wide fullword
      $s2 = "Virtual hardware upgrade helper service" fullword wide
      $s3 = "vmUpgradeHelper\\vmUpgradeHelper.pdb" ascii

Detection condition:
uint16(0) == 0x5a4d and
      filename == "VmUpgradeHelper.exe" and
      not all of ($s*)

Full rule:
rule COZY_FANCY_BEAR_modified_VmUpgradeHelper {
   meta:
      description = "Detects a malicious VmUpgradeHelper.exe as mentioned in the CrowdStrike report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
      date = "2016-06-14"
      id = "97b844a4-0fa4-5850-8803-2212a69e3d16"
   strings:
      $s1 = "VMware, Inc." wide fullword
      $s2 = "Virtual hardware upgrade helper service" fullword wide
      $s3 = "vmUpgradeHelper\\vmUpgradeHelper.pdb" ascii
   condition:
      uint16(0) == 0x5a4d and
      filename == "VmUpgradeHelper.exe" and
      not all of ($s*)
}
YARA Detection Rule: IronTiger_Gh0stRAT_variant
Repository: Neo23x0/signature-base
Detects: This is a detection for a s.exe variant seen in Op. Iron Tiger
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "Game Over Good Luck By Wind" nocase wide ascii
      $str2 = "ReleiceName" nocase wide ascii
      $str3 = "jingtisanmenxiachuanxiao.vbs" nocase wide ascii
      $str4 = "Winds Update" nocase wide ascii fullword

Detection condition:
uint16(0) == 0x5a4d and (any of ($str*))
      and not filename == "UpdateSystemMib.exe"

Full rule:
rule IronTiger_Gh0stRAT_variant {
   meta:
      author = "Cyber Safety Solutions, Trend Micro"
      description = "This is a detection for a s.exe variant seen in Op. Iron Tiger"
      reference = "http://goo.gl/T5fSJC"
      id = "e7eeee0f-d7a1-5359-bc1f-5a2a883c7227"
   strings:
      $str1 = "Game Over Good Luck By Wind" nocase wide ascii
      $str2 = "ReleiceName" nocase wide ascii
      $str3 = "jingtisanmenxiachuanxiao.vbs" nocase wide ascii
      $str4 = "Winds Update" nocase wide ascii fullword
   condition:
      uint16(0) == 0x5a4d and (any of ($str*))
      and not filename == "UpdateSystemMib.exe"
}
YARA Detection Rule: OpCloudHopper_Cloaked_PSCP
Repository: Neo23x0/signature-base
Detects: Tool used in Operation Cloud Hopper - pscp.exe cloaked as rundll32.exe
Author: Florian Roth (Nextron Systems)
Reference: https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

Pattern signatures:
$s1 = "AES-256 SDCTR" ascii
      $s2 = "direct-tcpip" ascii

Detection condition:
all of them and filename == "rundll32.exe"

Full rule:
rule OpCloudHopper_Cloaked_PSCP {
   meta:
      description = "Tool used in Operation Cloud Hopper - pscp.exe cloaked as rundll32.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
      date = "2017-04-07"
      score = 90
      id = "c1e2e456-dbdd-54cf-b0e0-b356f291cfcd"
   strings:
      $s1 = "AES-256 SDCTR" ascii
      $s2 = "direct-tcpip" ascii
   condition:
      all of them and filename == "rundll32.exe"
}
YARA Detection Rule: msi_dll_Anomaly
Repository: Neo23x0/signature-base
Detects: Detetcs very small and supicious msi.dll
Author: Florian Roth (Nextron Systems)
Reference: https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar

Pattern signatures:
$x1 = "msi.dll.eng" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 15KB and filename == "msi.dll" and $x1

Full rule:
rule msi_dll_Anomaly {
   meta:
      description = "Detetcs very small and supicious msi.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
      date = "2017-02-10"
      hash1 = "8c9048e2f5ea2ef9516cac06dc0fba8a7e97754468c0d9dc1e5f7bce6dbda2cc"
      id = "92cd5c51-ed84-5428-9105-50139f9289c8"
   strings:
      $x1 = "msi.dll.eng" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 15KB and filename == "msi.dll" and $x1
}
YARA Detection Rule: PoS_Malware_MalumPOS_Config
Repository: Neo23x0/signature-base
Detects: MalumPOS Config File
Author: Florian Roth (Nextron Systems)
Reference: http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-malumpos-targets-hotels-and-other-us-industries/

Pattern signatures:
$s1 = "[PARAMS]"
      $s2 = "Name="
      $s3 = "InterfacesIP="
      $s4 = "Port="

Detection condition:
all of ($s*) and filename == "log.ini" and filesize < 20KB

Full rule:
rule PoS_Malware_MalumPOS_Config {
   meta:
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "2015-06-25"
      description = "MalumPOS Config File"
      reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-malumpos-targets-hotels-and-other-us-industries/"
      id = "0fd2b9c2-d016-5db2-8fcc-618df6c815de"
   strings:
      $s1 = "[PARAMS]"
      $s2 = "Name="
      $s3 = "InterfacesIP="
      $s4 = "Port="
   condition:
      all of ($s*) and filename == "log.ini" and filesize < 20KB
}
YARA Detection Rule: Malware_QA_update_test
Repository: Neo23x0/signature-base
Detects: VT Research QA uploaded malware - file update_.exe
Author: Florian Roth (Nextron Systems)
Reference: VT Research QA

Pattern signatures:
$s1 = "test.exe" fullword ascii
      $s2 = "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGP" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and all of them and filename == "update.exe"

Full rule:
rule Malware_QA_update_test {
   meta:
      description = "VT Research QA uploaded malware - file update_.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "VT Research QA"
      date = "2016-08-29"
      score = 80
      hash1 = "3b3392bc730ded1f97c51e23611740ff8b218abf0a1100903de07819eeb449aa"
      id = "8f319277-1eaf-559e-87ad-f4ab89b04ca5"
   strings:
      $s1 = "test.exe" fullword ascii
      $s2 = "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGP" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and all of them and filename == "update.exe"
}
YARA Detection Rule: SysInterals_PipeList_NameChanged
Repository: Neo23x0/signature-base
Detects: Detects NirSoft PipeList
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/Mr6M2J

Pattern signatures:
$s1 = "PipeList" ascii fullword
      $s2 = "Sysinternals License" ascii fullword

Detection condition:
uint16(0) == 0x5a4d and filesize < 170KB and all of them
      and not filename contains "pipelist.exe"
      and not filename contains "PipeList.exe"

Full rule:
rule SysInterals_PipeList_NameChanged {
   meta:
      description = "Detects NirSoft PipeList"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/Mr6M2J"
      date = "2016-06-04"
      score = 90
      hash1 = "83f0352c14fa62ae159ab532d85a2b481900fed50d32cc757aa3f4ccf6a13bee"
      id = "01afcf29-a74c-5be2-8b24-694a2802ef34"
   strings:
      $s1 = "PipeList" ascii fullword
      $s2 = "Sysinternals License" ascii fullword
   condition:
      uint16(0) == 0x5a4d and filesize < 170KB and all of them
      and not filename contains "pipelist.exe"
      and not filename contains "PipeList.exe"
}
YARA Detection Rule: SCT_Scriptlet_in_Temp_Inet_Files
Repository: Neo23x0/signature-base
Detects: Detects a scriptlet file in the temporary Internet files (see regsvr32 AppLocker bypass)
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/KAB8Jw

Pattern signatures:
$s1 = "<scriptlet>" fullword ascii nocase
      $s2 = "ActiveXObject(\"WScript.Shell\")" ascii

Detection condition:
(uint32(0) == 0x4D583F3C or uint32(0) == 0x6D78F3C)  /* <?XM or <?xm */
      and $s1 and $s2
      and filepath contains "Temporary Internet Files"

Full rule:
rule SCT_Scriptlet_in_Temp_Inet_Files {
   meta:
      description = "Detects a scriptlet file in the temporary Internet files (see regsvr32 AppLocker bypass)"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://goo.gl/KAB8Jw"
      date = "2016-04-26"
      id = "8b[PII_REDACTED]-59b2-961c-dae1085cbbf6"
   strings:
      $s1 = "<scriptlet>" fullword ascii nocase
      $s2 = "ActiveXObject(\"WScript.Shell\")" ascii
   condition:
      (uint32(0) == 0x4D583F3C or uint32(0) == 0x6D78F3C)  /* <?XM or <?xm */
      and $s1 and $s2
      and filepath contains "Temporary Internet Files"
}
YARA Detection Rule: GIFCloaked_Webshell_A
Repository: Neo23x0/signature-base
Detects: Looks like a webshell cloaked as GIF
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "input type"
      $s1 = "<%eval request"
      $s2 = "<%eval(Request.Item["
      $s3 = "LANGUAGE='VBScript'"
      $s4 = "$_REQUEST" fullword
      $s5 = ";eval("
      $s6 = "base64_decode"

      $fp1 = "<form name=\"social_form\""

Detection condition:
uint32(0) == 0x38464947 and (1 of ($s*))
      and not 1 of ($fp*)

Full rule:
rule GIFCloaked_Webshell_A {
   meta:
      description = "Looks like a webshell cloaked as GIF"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      hash = "f1c95b13a71ca3629a0bb79601fcacf57cdfcf768806a71b26f2448f8c1d5d24"
      score = 60
      id = "4fdef65c-204a-5019-9b4f-c5877c3e39d4"
   strings:
      $s0 = "input type"
      $s1 = "<%eval request"
      $s2 = "<%eval(Request.Item["
      $s3 = "LANGUAGE='VBScript'"
      $s4 = "$_REQUEST" fullword
      $s5 = ";eval("
      $s6 = "base64_decode"

      $fp1 = "<form name=\"social_form\""
   condition:
      uint32(0) == 0x38464947 and (1 of ($s*))
      and not 1 of ($fp*)
}
YARA Detection Rule: exploit_ole_stdolelink
Repository: Neo23x0/signature-base
Detects: StdOleLink, potential 0day in April 2017
Author: David Cannings

Pattern signatures:
// Parsers will open files without the full 'rtf'
    $header_rtf = "{\\rt" nocase
    $header_office = { D0 CF 11 E0 }
    $header_xml = "<?xml version=" nocase wide ascii

    // Marks of embedded data (reduce FPs)
    // RTF format
    $embedded_object   = "\\object" nocase
    $embedded_objdata  = "\\objdata" nocase
    $embedded_ocx      = "\\objocx" nocase
    $embedded_objclass = "\\objclass" nocase
    $embedded_oleclass = "\\oleclsid" nocase

    // XML Office documents
    $embedded_axocx      = "<ax:ocx"  nocase wide ascii
    $embedded_axclassid  = "ax:classid"  nocase wide ascii

    // OLE format
    $embedded_root_entry = "Root Entry" wide
    $embedded_comp_obj   = "Comp Obj" wide
    $embedded_obj_info   = "Obj Info" wide
    $embedded_ole10      = "Ole10Native" wide

    $data0 = "[PII_REDACTED]-C[PII_REDACTED]00046" nocase wide ascii
    $data2 = "OLE2Link" nocase wide ascii
    $data3 = "4f4c45324c696e6b" nocase wide ascii
    $data4 = "StdOleLink" nocase wide asci

Detection condition:
// Mandatory header plus sign of embedding, then any of the others
    for any of ($header*) : ( @ == 0 ) and 1 of ($embedded*)
        and (1 of ($data*))
        and extension != ".msi"

Full rule:
rule exploit_ole_stdolelink {
  meta:
    author = "David Cannings"
    description = "StdOleLink, potential 0day in April 2017"
    score = 55
  strings:
    // Parsers will open files without the full 'rtf'
    $header_rtf = "{\\rt" nocase
    $header_office = { D0 CF 11 E0 }
    $header_xml = "<?xml version=" nocase wide ascii

    // Marks of embedded data (reduce FPs)
    // RTF format
    $embedded_object   = "\\object" nocase
    $embedded_objdata  = "\\objdata" nocase
    $embedded_ocx      = "\\objocx" nocase
    $embedded_objclass = "\\objclass" nocase
    $embedded_oleclass = "\\oleclsid" nocase

    // XML Office documents
    $embedded_axocx      = "<ax:ocx"  nocase wide ascii
    $embedded_axclassid  = "ax:classid"  nocase wide ascii

    // OLE format
    $embedded_root_entry = "Root Entry" wide
    $embedded_comp_obj   = "Comp Obj" wide
    $embedded_obj_info   = "Obj Info" wide
    $embedded_ole10      = "Ole10Native" wide

    $data0 = "[PII_REDACTED]-C[PII_REDACTED]00046" nocase wide ascii
    $data2 = "OLE2Link" nocase wide ascii
    $data3 = "4f4c45324c696e6b" nocase wide ascii
    $data4 = "StdOleLink" nocase wide ascii
    $data5 = "5374644f6c654c696e6b" nocase wide ascii

  condition:
    // Mandatory header plus sign of embedding, then any of the others
    for any of ($header*) : ( @ == 0 ) and 1 of ($embedded*)
        and (1 of ($data*))
        and extension != ".msi"
}
YARA Detection Rule: HackTool_Producers
Repository: Neo23x0/signature-base
Detects: Hacktool Producers String

Pattern signatures:
$a1 = "www.oxid.it"
      $a2 = "www.analogx.com"
      $a3 = "ntsecurity.nu"
      $a4 = "gentilkiwi.com"
      $a6 = "Marcus Murray"
      $a7 = "Nsasoft US LLC0"
      $a8 = " Nir Sofer"

Detection condition:
uint16(0) == 0x5a4d and 1 of ($a*) and
      not extension contains ".ini" and
      not extension contains ".xml" and
      not extension contains ".sqlite"

Full rule:
rule HackTool_Producers {
   meta:
      description = "Hacktool Producers String"
      threat_level = 5
      score = 50
      nodeepdive = 1
      id = "75cb2c86-0eaa-5cf5-96d8-85b91054de36"
   strings:
      $a1 = "www.oxid.it"
      $a2 = "www.analogx.com"
      $a3 = "ntsecurity.nu"
      $a4 = "gentilkiwi.com"
      $a6 = "Marcus Murray"
      $a7 = "Nsasoft US LLC0"
      $a8 = " Nir Sofer"
   condition:
      uint16(0) == 0x5a4d and 1 of ($a*) and
      not extension contains ".ini" and
      not extension contains ".xml" and
      not extension contains ".sqlite"
}
YARA Detection Rule: Exe_Cloaked_as_ThumbsDb
Repository: Neo23x0/signature-base
Detects: Detects an executable cloaked as thumbs.db - Malware
Author: Florian Roth (Nextron Systems)

Detection condition:
uint16(0) == 0x5a4d and filename matches /[Tt]humbs\.db/

Full rule:
rule Exe_Cloaked_as_ThumbsDb {
   meta:
      description = "Detects an executable cloaked as thumbs.db - Malware"
      date = "2014-07-18"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      score = 50
      id = "ff09f8cf-de5a-50fc-aa0b-c54f7667e246"
   condition:
      uint16(0) == 0x5a4d and filename matches /[Tt]humbs\.db/
}
YARA Detection Rule: Fake_AdobeReader_EXE
Repository: Neo23x0/signature-base
Detects: Detects an fake AdobeReader executable based on filesize OR missing strings in file
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "Adobe Systems" ascii

      $fp1 = "Adobe Reader" ascii wide
      $fp2 = "Xenocode Virtual Appliance Runtime" ascii wide

Detection condition:
uint16(0) == 0x5a4d and
      filename matches /AcroRd32.exe/i and
      not $s1 in (filesize - 2500..filesize)
      and not 1 of ($fp*)

Full rule:
rule Fake_AdobeReader_EXE {
   meta:
      description = "Detects an fake AdobeReader executable based on filesize OR missing strings in file"
      date = "2014-09-11"
      author = "Florian Roth (Nextron Systems)"
      score = 50
      nodeepdive = 1
      nodeepdive = 1
      id = "e3dd9d94-9f4b-5ff9-bfec-29abfb3555bb"
   strings:
      $s1 = "Adobe Systems" ascii

      $fp1 = "Adobe Reader" ascii wide
      $fp2 = "Xenocode Virtual Appliance Runtime" ascii wide
   condition:
      uint16(0) == 0x5a4d and
      filename matches /AcroRd32.exe/i and
      not $s1 in (filesize - 2500..filesize)
      and not 1 of ($fp*)
}
YARA Detection Rule: mimikatz_lsass_mdmp
Repository: Neo23x0/signature-base
Detects: LSASS minidump file for mimikatz
Author: Benjamin DELPY (gentilkiwi)

Pattern signatures:
$lsass = "System32\\lsass.exe" wide nocase

Detection condition:
(uint32(0) == 0x504d444d) and $lsass and filesize > 50000KB and not filename matches /WER/

Full rule:
rule mimikatz_lsass_mdmp {
   meta:
      description = "LSASS minidump file for mimikatz"
      author = "Benjamin DELPY (gentilkiwi)"
      id = "3d850dbe-1342-55ac-b0f7-91343d88f147"
   strings:
      $lsass = "System32\\lsass.exe" wide nocase
   condition:
      (uint32(0) == 0x504d444d) and $lsass and filesize > 50000KB and not filename matches /WER/
}