deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Codoso_PGV_PVID_4
Repository: Neo23x0/signature-base
Detects: Detects Codoso APT PlugX Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$x1 = "dropper, Version 1.0" fullword wide
		$x2 = "dropper" fullword wide
		$x3 = "DROPPER" fullword wide
		$x4 = "About dropper" fullword wide

		$s1 = "Microsoft Windows Manager Utility" fullword wide
		$s2 = "SYSTEM\\CurrentControlSet\\Services\\" ascii /* Goodware String - occured 9 times */
		$s3 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify" fullword ascii /* Goodware String - occured 10 times */
		$s4 = "<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"><trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3" ascii /* Goodware String - occured 46 times */
		$s5 = "<supportedOS Id=\"{e2[PII_REDACTED]-43c5-a5fe-008deee3d3f0}\"></supportedOS>" fullword ascii /* Goodware String - occured 65 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 900KB and 2 of ($x*) and 2 of ($s*)

Full rule:
rule Codoso_PGV_PVID_4 {
	meta:
		description = "Detects Codoso APT PlugX Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		super_rule = 1
		hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
		hash2 = "8a56b476d792983aea0199ee3226f0d04792b70a1c1f05f399cb6e4ce8a38761"
		hash3 = "b2950f2e09f5356e985c38b284ea52175d21feee12e582d674c0da2233b1feb1"
		hash4 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
		hash5 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
		id = "c1c753a6-77b6-5bfb-89f9-16127c264fd0"
	strings:
		$x1 = "dropper, Version 1.0" fullword wide
		$x2 = "dropper" fullword wide
		$x3 = "DROPPER" fullword wide
		$x4 = "About dropper" fullword wide

		$s1 = "Microsoft Windows Manager Utility" fullword wide
		$s2 = "SYSTEM\\CurrentControlSet\\Services\\" ascii /* Goodware String - occured 9 times */
		$s3 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify" fullword ascii /* Goodware String - occured 10 times */
		$s4 = "<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"><trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3" ascii /* Goodware String - occured 46 times */
		$s5 = "<supportedOS Id=\"{e2[PII_REDACTED]-43c5-a5fe-008deee3d3f0}\"></supportedOS>" fullword ascii /* Goodware String - occured 65 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 900KB and 2 of ($x*) and 2 of ($s*)
}
YARA Detection Rule: Codoso_PlugX_1
Repository: Neo23x0/signature-base
Detects: Detects Codoso APT PlugX Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$s1 = "GETPASSWORD1" fullword ascii
		$s2 = "NvSmartMax.dll" fullword ascii
		$s3 = "LICENSEDLG" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 800KB and all of them

Full rule:
rule Codoso_PlugX_1 {
	meta:
		description = "Detects Codoso APT PlugX Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		super_rule = 1
		hash1 = "0b8cbc9b4761ab35acce2aa12ba2c0a283afd596b565705514fd802c8b1e144b"
		hash2 = "448711bd3f689ceebb736d25253233ac244d48cb766834b8f974c2e9d4b462e8"
		hash3 = "fd22547497ce[PII_REDACTED]2429eeff0599d0b11fe61186e91c91e1f76b518fe2"
		id = "af777818-5cff-5571-b5e9-0f5a4c8b08ff"
	strings:
		$s1 = "GETPASSWORD1" fullword ascii
		$s2 = "NvSmartMax.dll" fullword ascii
		$s3 = "LICENSEDLG" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 800KB and all of them
}
YARA Detection Rule: Codoso_PGV_PVID_3
Repository: Neo23x0/signature-base
Detects: Detects Codoso APT PGV PVID Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$x1 = "Copyright (C) Microsoft Corporation.  All rights reserved.(C) 2012" fullword wide

Detection condition:
$x1

Full rule:
rule Codoso_PGV_PVID_3 {
	meta:
		description = "Detects Codoso APT PGV PVID Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		super_rule = 1
		hash1 = "126fbdcfed1dfb31865d4b18db2fb963f49df838bf66922fea0c37e06666aee1"
		hash2 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
		hash3 = "8a56b476d792983aea0199ee3226f0d04792b70a1c1f05f399cb6e4ce8a38761"
		hash4 = "b2950f2e09f5356e985c38b284ea52175d21feee12e582d674c0da2233b1feb1"
		hash5 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
		hash6 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
		id = "08003dba-1201-5f74-9edd-ea321bb26e99"
	strings:
		$x1 = "Copyright (C) Microsoft Corporation.  All rights reserved.(C) 2012" fullword wide
	condition:
		$x1
}
YARA Detection Rule: Codoso_PGV_PVID_2
Repository: Neo23x0/signature-base
Detects: Detects Codoso APT PGV PVID Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$s0 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SvcHost" fullword ascii
		$s1 = "regsvr32.exe /s \"%s\"" fullword ascii
		$s2 = "Help and Support" fullword ascii
		$s3 = "netsvcs" fullword ascii
		$s9 = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" fullword ascii /* Goodware String - occured 4 times */
		$s10 = "winlogon" fullword ascii /* Goodware String - occured 4 times */
		$s11 = "System\\CurrentControlSet\\Services" fullword ascii /* Goodware String - occured 11 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 907KB and all of them

Full rule:
rule Codoso_PGV_PVID_2 {
	meta:
		description = "Detects Codoso APT PGV PVID Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		super_rule = 1
		hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
		hash2 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
		hash3 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
		id = "e4c00806-3092-5ec2-844f-b638c31fa6a5"
	strings:
		$s0 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SvcHost" fullword ascii
		$s1 = "regsvr32.exe /s \"%s\"" fullword ascii
		$s2 = "Help and Support" fullword ascii
		$s3 = "netsvcs" fullword ascii
		$s9 = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" fullword ascii /* Goodware String - occured 4 times */
		$s10 = "winlogon" fullword ascii /* Goodware String - occured 4 times */
		$s11 = "System\\CurrentControlSet\\Services" fullword ascii /* Goodware String - occured 11 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 907KB and all of them
}
YARA Detection Rule: Codoso_PGV_PVID_1
Repository: Neo23x0/signature-base
Detects: Detects Codoso APT PGV PVID Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$x1 = "DRIVERS\\ipinip.sys" fullword wide

      $s1 = "TsWorkSpaces.dll" fullword ascii
      $s2 = "%SystemRoot%\\System32\\wiaservc.dll" fullword wide
      $s3 = "/selfservice/microsites/search.php?%016I64d" fullword ascii
      $s4 = "/solutions/company-size/smb/index.htm?%016I64d" fullword ascii
      $s5 = "Microsoft Chart ActiveX Control" fullword wide
      $s6 = "MSChartCtrl.ocx" fullword wide
      $s7 = "{%08X-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X}" fullword ascii
      $s8 = "WUServiceMain" fullword ascii /* Goodware String - occured 2 times */
      $s9 = "Cookie: pgv_pvid=" ascii

Detection condition:
( uint16(0) == 0x5a4d and ( 1 of ($x*) or 3 of them ) ) or
      5 of them

Full rule:
rule Codoso_PGV_PVID_1 {
   meta:
      description = "Detects Codoso APT PGV PVID Malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
      date = "2016-01-30"
      super_rule = 1
      hash1 = "41a936b0d1fd90dffb2f6d0bcaf4ad0536f93ca7591f7b75b0cd1af8804d0824"
      hash2 = "58334eb7fed37e3104d8235d918aa5b7856f33ea52a74cf90a5ef5542a404ac3"
      hash3 = "934b87ddceabb2063b5e5bc4f964628fe0c63b63bb2346b105ece19915384fc7"
      hash4 = "ce91ea20aa2e6af79508dd0a40ab0981f463b4d2714de55e66d228c579578266"
      hash5 = "e770a298ae819bba1c70d0c9a2e02e4680d3cdba22d558d21caaa74e3970adf1"
      id = "9487773a-01d9-558e-8866-b8a8650996ba"
   strings:
      $x1 = "DRIVERS\\ipinip.sys" fullword wide

      $s1 = "TsWorkSpaces.dll" fullword ascii
      $s2 = "%SystemRoot%\\System32\\wiaservc.dll" fullword wide
      $s3 = "/selfservice/microsites/search.php?%016I64d" fullword ascii
      $s4 = "/solutions/company-size/smb/index.htm?%016I64d" fullword ascii
      $s5 = "Microsoft Chart ActiveX Control" fullword wide
      $s6 = "MSChartCtrl.ocx" fullword wide
      $s7 = "{%08X-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X}" fullword ascii
      $s8 = "WUServiceMain" fullword ascii /* Goodware String - occured 2 times */
      $s9 = "Cookie: pgv_pvid=" ascii
   condition:
      ( uint16(0) == 0x5a4d and ( 1 of ($x*) or 3 of them ) ) or
      5 of them
}
YARA Detection Rule: APT_MAL_LNX_Kobalos
Repository: Neo23x0/signature-base
Detects: Kobalos malware
Author: Marc-Etienne M.Leveille
Reference: https://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure/

Pattern signatures:
$encrypted_strings_sizes = {
            05 00 00 00 09 00 00 00  04 00 00 00 06 00 00 00
            08 00 00 00 08 00 00 00  02 00 00 00 02 00 00 00
            01 00 00 00 01 00 00 00  05 00 00 00 07 00 00 00
            05 00 00 00 05 00 00 00  05 00 00 00 0A 00 00 00
        }
        $password_md5_digest = { 3ADD48192654BD558A4A4CED9C255C4C }
        $rsa_512_mod_header = { 10 11 02 00 09 02 00 }
        $strings_rc4_key = { AE0E05090F3AC2B50B1BC6E91D2FE3CE }

Detection condition:
uint16(0) == 0x457f and /* modification by Florian Roth to avoid false posirives */
        any of them

Full rule:
rule APT_MAL_LNX_Kobalos {
    meta:
        description = "Kobalos malware"
        author = "Marc-Etienne M.Leveille"
        date = "2020-11-02"
        reference = "https://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure/"
        source = "https://github.com/eset/malware-ioc/"
        license = "BSD 2-Clause"
        version = "1"

        id = "dfa47e30-c093-57f6-af01-72a2534cc6f4"
    strings:
        $encrypted_strings_sizes = {
            05 00 00 00 09 00 00 00  04 00 00 00 06 00 00 00
            08 00 00 00 08 00 00 00  02 00 00 00 02 00 00 00
            01 00 00 00 01 00 00 00  05 00 00 00 07 00 00 00
            05 00 00 00 05 00 00 00  05 00 00 00 0A 00 00 00
        }
        $password_md5_digest = { 3ADD48192654BD558A4A4CED9C255C4C }
        $rsa_512_mod_header = { 10 11 02 00 09 02 00 }
        $strings_rc4_key = { AE0E05090F3AC2B50B1BC6E91D2FE3CE }

    condition:
        uint16(0) == 0x457f and /* modification by Florian Roth to avoid false posirives */
        any of them
}
YARA Detection Rule: APT_MAL_LNX_Kobalos_SSH_Credential_Stealer
Repository: Neo23x0/signature-base
Detects: Kobalos SSH credential stealer seen in OpenSSH client
Author: Marc-Etienne M.Leveille
Reference: https://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure/

Pattern signatures:
$ = "user: %.128s host: %.128s port %05d user: %.128s password: %.128s"

Detection condition:
uint16(0) == 0x457f and /* modification by Florian Roth to avoid false posirives */
        any of them

Full rule:
rule APT_MAL_LNX_Kobalos_SSH_Credential_Stealer {
    meta:
        description = "Kobalos SSH credential stealer seen in OpenSSH client"
        author = "Marc-Etienne M.Leveille"
        date = "2020-11-02"
        reference = "https://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure/"
        source = "https://github.com/eset/malware-ioc/"
        license = "BSD 2-Clause"
        version = "1"

        id = "0f923f92-c5d8-500d-9a2e-634ca7945c5c"
    strings:
        $ = "user: %.128s host: %.128s port %05d user: %.128s password: %.128s"

    condition:
        uint16(0) == 0x457f and /* modification by Florian Roth to avoid false posirives */
        any of them
}
YARA Detection Rule: apt_nix_elf_derusbi
Repository: Neo23x0/signature-base
Detects: Detects Derusbi Backdoor ELF
Author: Fidelis Cybersecurity
Reference: https://github.com/fideliscyber/indicators/tree/master/FTA-1021

Pattern signatures:
$s1 = "LxMain"
      $s2 = "execve"
      $s3 = "kill"
      $s4 = "cp -a %s %s"
      $s5 = "%s &"
      $s6 = "dbus-daemon"
      $s7 = "--noprofile"
      $s8 = "--norc"
      $s9 = "TERM=vt100"
      $s10 = "/proc/%u/cmdline"
      $s11 = "loadso"
      $s12 = "/proc/self/exe"
      $s13 = "Proxy-Connection: Keep-Alive"
      $s14 = "Connection: Keep-Alive"
      $s15 = "CONNECT %s"
      $s16 = "HOST: %s:%d"
      $s17 = "User-Agent: Mozilla/4.0"
      $s18 = "Proxy-Authorization: Basic %s"
      $s19 = "Server: Apache"
      $s20 = "Proxy-Authenticate"
      $s21 = "gettimeofday"
      $s22 = "pthread_create"
      $s23 = "pthread_join"
      $s24 = "pthread_mutex_init"
      $s25 = "pthread_mutex_destroy"
      $s26 = "pthread_mutex_lock"
      $s27 = "getsockopt"
      $s28 = "socket"
      $s29 = "setsockopt"
      $s30 = "select"
      $s31 = "bind"
      $s32 = "shutdown"
      $s33 = "listen"
      $s34 = "opendir"
      $s35 = "readdir"
      $s36 = "closedir"
      $s37 =

Detection condition:
uint32(0) == 0x464c457f and all of them

Full rule:
rule apt_nix_elf_derusbi {
   meta:
      description = "Detects Derusbi Backdoor ELF"
      author = "Fidelis Cybersecurity"
      date = "2016/02/29"
      modified = "2023-05-04"
      reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
      id = "c825c5d6-1c2f-5ee7-871e-4be3f41d73f7"
   strings:
      $s1 = "LxMain"
      $s2 = "execve"
      $s3 = "kill"
      $s4 = "cp -a %s %s"
      $s5 = "%s &"
      $s6 = "dbus-daemon"
      $s7 = "--noprofile"
      $s8 = "--norc"
      $s9 = "TERM=vt100"
      $s10 = "/proc/%u/cmdline"
      $s11 = "loadso"
      $s12 = "/proc/self/exe"
      $s13 = "Proxy-Connection: Keep-Alive"
      $s14 = "Connection: Keep-Alive"
      $s15 = "CONNECT %s"
      $s16 = "HOST: %s:%d"
      $s17 = "User-Agent: Mozilla/4.0"
      $s18 = "Proxy-Authorization: Basic %s"
      $s19 = "Server: Apache"
      $s20 = "Proxy-Authenticate"
      $s21 = "gettimeofday"
      $s22 = "pthread_create"
      $s23 = "pthread_join"
      $s24 = "pthread_mutex_init"
      $s25 = "pthread_mutex_destroy"
      $s26 = "pthread_mutex_lock"
      $s27 = "getsockopt"
      $s28 = "socket"
      $s29 = "setsockopt"
      $s30 = "select"
      $s31 = "bind"
      $s32 = "shutdown"
      $s33 = "listen"
      $s34 = "opendir"
      $s35 = "readdir"
      $s36 = "closedir"
      $s37 = "rename"
   condition:
      uint32(0) == 0x464c457f and all of them
}
YARA Detection Rule: apt_nix_elf_derusbi_kernelModule
Repository: Neo23x0/signature-base
Detects: Detects Derusbi Backdoor ELF Kernel Module
Author: Fidelis Cybersecurity
Reference: https://github.com/fideliscyber/indicators/tree/master/FTA-1021

Pattern signatures:
$s1 = "__this_module"
      $s2 = "init_module"
      $s3 = "unhide_pid"
      $s4 = "is_hidden_pid"
      $s5 = "clear_hidden_pid"
      $s6 = "hide_pid"
      $s7 = "license"
      $s8 = "description"
      $s9 = "srcversion="
      $s10 = "depends="
      $s12 = "vermagic="
      $s13 = "current_task"
      $s14 = "sock_release"
      $s15 = "module_layout"
      $s16 = "init_uts_ns"
      $s17 = "init_net"
      $s18 = "init_task"
      $s19 = "filp_open"
      $s20 = "__netlink_kernel_create"
      $s21 = "kfree_skb"

Detection condition:
uint32(0) == 0x464c457f and all of them

Full rule:
rule apt_nix_elf_derusbi_kernelModule
{
   meta:
      description = "Detects Derusbi Backdoor ELF Kernel Module"
      author = "Fidelis Cybersecurity"
      date = "2016/02/29"
      modified = "2023-05-04"
      reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
      id = "98196ffc-8a6f-5edc-a688-eeb449410b72"
   strings:
      $s1 = "__this_module"
      $s2 = "init_module"
      $s3 = "unhide_pid"
      $s4 = "is_hidden_pid"
      $s5 = "clear_hidden_pid"
      $s6 = "hide_pid"
      $s7 = "license"
      $s8 = "description"
      $s9 = "srcversion="
      $s10 = "depends="
      $s12 = "vermagic="
      $s13 = "current_task"
      $s14 = "sock_release"
      $s15 = "module_layout"
      $s16 = "init_uts_ns"
      $s17 = "init_net"
      $s18 = "init_task"
      $s19 = "filp_open"
      $s20 = "__netlink_kernel_create"
      $s21 = "kfree_skb"
   condition:
      uint32(0) == 0x464c457f and all of them
}
YARA Detection Rule: apt_nix_elf_Derusbi_Linux_SharedMemCreation
Repository: Neo23x0/signature-base
Detects: Detects Derusbi Backdoor ELF Shared Memory Creation
Author: Fidelis Cybersecurity
Reference: https://github.com/fideliscyber/indicators/tree/master/FTA-1021

Pattern signatures:
$byte1 = { B6 03 00 00 ?? 40 00 00 00 ?? 0D 5F 01 82 }

Detection condition:
uint32(0) == 0x464C457F and any of them

Full rule:
rule apt_nix_elf_Derusbi_Linux_SharedMemCreation {
   meta:
      description = "Detects Derusbi Backdoor ELF Shared Memory Creation"
      author = "Fidelis Cybersecurity"
      date = "2016/02/29"
      reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
      id = "068b7bea-853d-57e8-a9fe-8b451dbc7582"
   strings:
      $byte1 = { B6 03 00 00 ?? 40 00 00 00 ?? 0D 5F 01 82 }
   condition:
      uint32(0) == 0x464C457F and any of them
}
YARA Detection Rule: apt_nix_elf_Derusbi_Linux_Strings
Repository: Neo23x0/signature-base
Detects: Detects Derusbi Backdoor ELF Strings
Author: Fidelis Cybersecurity
Reference: https://github.com/fideliscyber/indicators/tree/master/FTA-1021

Pattern signatures:
$a1 = "loadso" wide ascii fullword
      $a2 = "\nuname -a\n\n" wide ascii
      $a3 = "/dev/shm/.x11.id" wide ascii
      $a4 = "LxMain64" wide ascii nocase
      $a5 = "# \\u@\\h:\\w \\$ " wide ascii
      $b1 = "[PII_REDACTED]abcdefghijklmnopqrstuvwxyz" wide
      $b2 = "[PII_REDACTED]ABCDEFGHIJKLMNOPQRSTUVWXYZ" wide
      $b3 = "ret %d" wide fullword
      $b4 = "uname -a\n\n" wide ascii
      $b5 = "/proc/%u/cmdline" wide ascii
      $b6 = "/proc/self/exe" wide ascii
      $b7 = "cp -a %s %s" wide ascii
      $c1 = "/dev/pts/4" wide ascii fullword
      $c2 = "/tmp/1408.log" wide ascii fullword

Detection condition:
uint32(0) == 0x464C457F and
      (
         (1 of ($a*) and 4 of ($b*) ) or
         (1 of ($a*) and 1 of ($c*)) or
         2 of ($a*) or
         all of ($b*)
      )

Full rule:
rule apt_nix_elf_Derusbi_Linux_Strings {
   meta:
      description = "Detects Derusbi Backdoor ELF Strings"
      author = "Fidelis Cybersecurity"
      date = "2016/02/29"
      reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
      id = "06717cc9-678d-5912-a671-65605b9c9968"
   strings:
      $a1 = "loadso" wide ascii fullword
      $a2 = "\nuname -a\n\n" wide ascii
      $a3 = "/dev/shm/.x11.id" wide ascii
      $a4 = "LxMain64" wide ascii nocase
      $a5 = "# \\u@\\h:\\w \\$ " wide ascii
      $b1 = "[PII_REDACTED]abcdefghijklmnopqrstuvwxyz" wide
      $b2 = "[PII_REDACTED]ABCDEFGHIJKLMNOPQRSTUVWXYZ" wide
      $b3 = "ret %d" wide fullword
      $b4 = "uname -a\n\n" wide ascii
      $b5 = "/proc/%u/cmdline" wide ascii
      $b6 = "/proc/self/exe" wide ascii
      $b7 = "cp -a %s %s" wide ascii
      $c1 = "/dev/pts/4" wide ascii fullword
      $c2 = "/tmp/1408.log" wide ascii fullword
   condition:
      uint32(0) == 0x464C457F and
      (
         (1 of ($a*) and 4 of ($b*) ) or
         (1 of ($a*) and 1 of ($c*)) or
         2 of ($a*) or
         all of ($b*)
      )
}
YARA Detection Rule: EXPL_Cleo_Exploitation_Log_Indicators_Dec24
Repository: Neo23x0/signature-base
Detects: Detects indicators found in logs during and after Cleo software exploitation (as reported by Huntress in December 2024)
Author: Florian Roth
Reference: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild

Pattern signatures:
$x1 = "Note: Processing autorun file 'autorun\\health" ascii wide
      $x2 = "60282967-dc91-40ef-a34c-38e992509c2c.xml" ascii wide
      $x3 = "<Detail level=\"1\">Executing 'cmd.exe /c \"powershell -NonInteractive -EncodedCommand " ascii wide

Detection condition:
1 of them

Full rule:
rule EXPL_Cleo_Exploitation_Log_Indicators_Dec24 : SCRIPT {
   meta:
      description = "Detects indicators found in logs during and after Cleo software exploitation (as reported by Huntress in December 2024)"
      author = "Florian Roth"
      reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
      date = "2024-12-10"
      score = 75
      id = "385042a9-fc8c-5b50-975f-3436a16e6861"
   strings:
      $x1 = "Note: Processing autorun file 'autorun\\health" ascii wide
      $x2 = "60282967-dc91-40ef-a34c-38e992509c2c.xml" ascii wide
      $x3 = "<Detail level=\"1\">Executing 'cmd.exe /c \"powershell -NonInteractive -EncodedCommand " ascii wide
   condition:
      1 of them
}