deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: MAL_RANSOM_REvil_Oct20_1
Repository: Neo23x0/signature-base
Detects: Detects REvil ransomware
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$op1 = { 0f 8c 74 ff ff ff 33 c0 5f 5e 5b 8b e5 5d c3 8b }
      $op2 = { 8d 85 68 ff ff ff 50 e8 2a fe ff ff 8d 85 68 ff }
      $op3 = { 89 4d f4 8b 4e 0c 33 4e 34 33 4e 5c 33 8e 84 }
      $op4 = { 8d 85 68 ff ff ff 50 e8 05 06 00 00 8d 85 68 ff }
      $op5 = { 8d 85 68 ff ff ff 56 57 ff 75 0c 50 e8 2f }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 400KB and
      2 of them or 4 of them

Full rule:
rule MAL_RANSOM_REvil_Oct20_1 {
   meta:
      description = "Detects REvil ransomware"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2020-10-13"
      hash1 = "5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4"
      hash2 = "f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5"
      hash3 = "f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d"
      hash4 = "fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501"
      id = "0c85a2cc-3487-577f-bd12-e3effd8fc811"
   strings:
      $op1 = { 0f 8c 74 ff ff ff 33 c0 5f 5e 5b 8b e5 5d c3 8b }
      $op2 = { 8d 85 68 ff ff ff 50 e8 2a fe ff ff 8d 85 68 ff }
      $op3 = { 89 4d f4 8b 4e 0c 33 4e 34 33 4e 5c 33 8e 84 }
      $op4 = { 8d 85 68 ff ff ff 50 e8 05 06 00 00 8d 85 68 ff }
      $op5 = { 8d 85 68 ff ff ff 56 57 ff 75 0c 50 e8 2f }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 400KB and
      2 of them or 4 of them
}
YARA Detection Rule: Brooxml_Hunting
Repository: Neo23x0/signature-base
Detects: Detects Microsoft OOXML files with prepended data/manipulated header
Author: Proofpoint
Reference: https://x.com/threatinsight/status/[PII_REDACTED]08763480

Pattern signatures:
$pk_ooxml_magic = {50 4b 03 04 [22] 13 00 [2] 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c}

        $pk_0102 = {50 4b 01 02}
        $pk_0304 = {50 4b 03 04}
        $pk_0506 = {50 4b 05 06}
        $pk_0708 = {50 4b 07 08}

        $word = "word/"

        // Negations for FPs / unwanted file types
        $ole = {d0 cf 11 e0}
        $tef = {78 9f 3e 22}

Detection condition:
$pk_ooxml_magic in (4..16384) and
        $pk_0506 in (16384..filesize) and
        #pk_0506 == 1 and
        #pk_0102 > 2 and
        #pk_0304 > 2 and
        $word and
        not ($pk_0102 at 0) and
        not ($pk_0304 at 0) and
        not ($pk_0506 at 0) and
        not ($pk_0708 at 0) and
  

Full rule:
rule Brooxml_Hunting {
    meta:
        description = "Detects Microsoft OOXML files with prepended data/manipulated header"
        author = "Proofpoint"
        category = "hunting"
        date = "2024-11-27"
        modified = "2025-06-02"
        score = 70
        reference = "https://x.com/threatinsight/status/[PII_REDACTED]08763480"
        id = "1ffea1c7-9f97-5bb1-93d7-ce914765416f"
    strings:
        $pk_ooxml_magic = {50 4b 03 04 [22] 13 00 [2] 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c}

        $pk_0102 = {50 4b 01 02}
        $pk_0304 = {50 4b 03 04}
        $pk_0506 = {50 4b 05 06}
        $pk_0708 = {50 4b 07 08}

        $word = "word/"

        // Negations for FPs / unwanted file types
        $ole = {d0 cf 11 e0}
        $tef = {78 9f 3e 22}
    condition:
        $pk_ooxml_magic in (4..16384) and
        $pk_0506 in (16384..filesize) and
        #pk_0506 == 1 and
        #pk_0102 > 2 and
        #pk_0304 > 2 and
        $word and
        not ($pk_0102 at 0) and
        not ($pk_0304 at 0) and
        not ($pk_0506 at 0) and
        not ($pk_0708 at 0) and
        not ($ole at 0) and
        not (uint16(0) == 0x5a4d) and
        not ($tef at 0)
}
YARA Detection Rule: Brooxml_Phishing
Repository: Neo23x0/signature-base
Detects: Detects PDF and OOXML files leading to AiTM phishing
Author: Proofpoint
Reference: https://x.com/threatinsight/status/[PII_REDACTED]08763480

Pattern signatures:
$hex1 = { 21 20 03 20 c3 be c3 bf 09 20 [0-1] 06 20 20 20 20 20 20 20 20 20 20 20 01 20 20 20 06 20 20 20 20 20 20 20 20 10 20 20 05 20 20 20 01 20 20 20 c3 be c3 bf c3 bf c3 bf }

Detection condition:
all of ($hex*) and ((uint16be(0) == 0x504b) or (uint32be(0) == 0x25504446))

Full rule:
rule Brooxml_Phishing {
    meta:
        description = "Detects PDF and OOXML files leading to AiTM phishing"
        author = "Proofpoint"
        category = "phishing"
        date = "2024-11-27"
        score = 65
        reference = "https://x.com/threatinsight/status/[PII_REDACTED]08763480"
        id = "ccd8ab30-90a4-5d4b-8a77-dbc4669bdb95"
    strings:
        $hex1 = { 21 20 03 20 c3 be c3 bf 09 20 [0-1] 06 20 20 20 20 20 20 20 20 20 20 20 01 20 20 20 06 20 20 20 20 20 20 20 20 10 20 20 05 20 20 20 01 20 20 20 c3 be c3 bf c3 bf c3 bf }
    condition:
        all of ($hex*) and ((uint16be(0) == 0x504b) or (uint32be(0) == 0x25504446))
}
YARA Detection Rule: SUSP_BAT_Aux_Jan20_1
Repository: Neo23x0/signature-base
Detects: Detects BAT file often dropped to cleanup temp dirs during infection
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@quoscient/the-chicken-keeps-laying-new-eggs-uncovering-new-gc-maas-tools-used-by-top-tier-threat-actors-531d80a6b4e9

Pattern signatures:
$s1 = "if exist \"C:\\Users\\" ascii
      $s2 = "\\AppData\\Local\\Temp\\" ascii
      $s3 = "del \"C:\\Users\\" ascii
      $s4 = ".bat\"" ascii
      $s5 = ".exe\" goto" ascii

Detection condition:
uint8(0) == 0x3a and filesize <= 1KB and all of them

Full rule:
rule SUSP_BAT_Aux_Jan20_1 {
   meta:
      description = "Detects BAT file often dropped to cleanup temp dirs during infection"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@quoscient/the-chicken-keeps-laying-new-eggs-uncovering-new-gc-maas-tools-used-by-top-tier-threat-actors-531d80a6b4e9"
      date = "2020-01-29"
      score = 65
      hash1 = "f5d558ec505b635b1e[PII_REDACTED]2ad6f79b3da5cf2cf74db6e6e648b7a47127"
      id = "c97f189e-a0c2-532e-b087-8669da72a2ad"
   strings:
      $s1 = "if exist \"C:\\Users\\" ascii
      $s2 = "\\AppData\\Local\\Temp\\" ascii
      $s3 = "del \"C:\\Users\\" ascii
      $s4 = ".bat\"" ascii
      $s5 = ".exe\" goto" ascii
   condition:
      uint8(0) == 0x3a and filesize <= 1KB and all of them
}
YARA Detection Rule: Kriskynote_Mar17_1
Repository: Neo23x0/signature-base
Detects: Detects Kriskynote Malware
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "gzwrite64" fullword ascii

      $opa1 = { e8 6b fd ff ff 83 f8 ff 74 65 83 7b 28 00 74 42 } /* Opcode */

      $opb1 = { 8a 04 08 8b 8e a4 16 00 00 88 44 24 0c 66 c7 04 } /* Opcode */
      $opb2 = { 89 4e 6c 89 46 74 e9 ad fc ff ff 8b 46 68 85 c0 } /* Opcode */

Detection condition:
uint16(0) == 0x5a4d and filesize < 400KB and $s1 and ($opa1 or all of ($opb*))

Full rule:
rule Kriskynote_Mar17_1 {
   meta:
      description = "Detects Kriskynote Malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-03-03"
      hash1 = "a19c4b615aa54207604b181873e614d84126b639fee2cce3ca9d5bd863f6f577"
      hash2 = "62b41db0bf63fa45a2c2b0f5df8c2209a5d96bf2bddf82749595c66d30b7ec61"
      id = "b1e5df0c-0112-5fee-85e9-cb0ca31f5234"
   strings:
      $s1 = "gzwrite64" fullword ascii

      $opa1 = { e8 6b fd ff ff 83 f8 ff 74 65 83 7b 28 00 74 42 } /* Opcode */

      $opb1 = { 8a 04 08 8b 8e a4 16 00 00 88 44 24 0c 66 c7 04 } /* Opcode */
      $opb2 = { 89 4e 6c 89 46 74 e9 ad fc ff ff 8b 46 68 85 c0 } /* Opcode */
   condition:
      uint16(0) == 0x5a4d and filesize < 400KB and $s1 and ($opa1 or all of ($opb*))
}
YARA Detection Rule: Kriskynote_Mar17_2
Repository: Neo23x0/signature-base
Detects: Detects Kriskynote Malware
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "fgjfcn8456fgjhfg89653wetwts" fullword ascii
      $op0 = { 33 c0 80 34 30 03 40 3d e6 21 00 00 72 f4 b8 e6 } /* Opcode */

Detection condition:
( uint16(0) == 0x5a4d and filesize < 600KB and 1 of them )

Full rule:
rule Kriskynote_Mar17_2 {
   meta:
      description = "Detects Kriskynote Malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-03-03"
      hash1 = "cb9a2f77868b28d98e4f9c1b27b7242fec2f2abbc91bfc21fe0573e472c5dfcb"
      id = "704baf41-9718-537f-9456-381a9f42fb97"
   strings:
      $s1 = "fgjfcn8456fgjhfg89653wetwts" fullword ascii
      $op0 = { 33 c0 80 34 30 03 40 3d e6 21 00 00 72 f4 b8 e6 } /* Opcode */
   condition:
      ( uint16(0) == 0x5a4d and filesize < 600KB and 1 of them )
}
YARA Detection Rule: Kriskynote_Mar17_3
Repository: Neo23x0/signature-base
Detects: Detects Kriskynote Malware
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "rundll32 %s Check" fullword ascii
      $s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs" fullword ascii
      $s3 = "name=\"IsUserAdmin\"" fullword ascii
      $s4 = "zok]\\\\\\ZZYYY666564444" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and 2 of them )

Full rule:
rule Kriskynote_Mar17_3 {
   meta:
      description = "Detects Kriskynote Malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-03-03"
      hash1 = "fc838e07834994f25b3b271611e1014b3593278f0703a4a985fb4234936df492"
      id = "647fac4c-2326-5a68-9[PII_REDACTED]c1548"
   strings:
      $s1 = "rundll32 %s Check" fullword ascii
      $s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs" fullword ascii
      $s3 = "name=\"IsUserAdmin\"" fullword ascii
      $s4 = "zok]\\\\\\ZZYYY666564444" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and 2 of them )
}
YARA Detection Rule: APT_SAP_NetWeaver_Exploitation_Activity_Apr25_1
Repository: Neo23x0/signature-base
Detects: Detects forensic artefacts related to exploitation activity of SAP NetWeaver CVE-2025-31324
Author: Florian Roth
Reference: https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/

Pattern signatures:
$x01 = "/helper.jsp?cmd=" ascii wide
      $x02 = "/cache.jsp?cmd=" ascii wide

Detection condition:
filesize < 20MB and 1 of them

Full rule:
rule APT_SAP_NetWeaver_Exploitation_Activity_Apr25_1 : SCRIPT {
   meta:
      description = "Detects forensic artefacts related to exploitation activity of SAP NetWeaver CVE-2025-31324"
      reference = "https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/"
      author = "Florian Roth"
      date = "2025-04-25"
      score = 70
   strings:
      $x01 = "/helper.jsp?cmd=" ascii wide
      $x02 = "/cache.jsp?cmd=" ascii wide
   condition:
      filesize < 20MB and 1 of them
}
YARA Detection Rule: APT_SAP_NetWeaver_Exploitation_Activity_Apr25_2
Repository: Neo23x0/signature-base
Detects: Detects forensic artefacts related to exploitation activity of SAP NetWeaver CVE-2025-31324
Author: Florian Roth
Reference: https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/

Pattern signatures:
$x03 = "MSBuild.exe c:\\programdata\\" ascii wide

Detection condition:
filesize < 20MB and 1 of them

Full rule:
rule APT_SAP_NetWeaver_Exploitation_Activity_Apr25_2 : SCRIPT {
   meta:
      description = "Detects forensic artefacts related to exploitation activity of SAP NetWeaver CVE-2025-31324"
      reference = "https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/"
      author = "Florian Roth"
      date = "2025-04-25"
      score = 70
   strings:
      $x03 = "MSBuild.exe c:\\programdata\\" ascii wide
   condition:
      filesize < 20MB and 1 of them
}
YARA Detection Rule: SUSP_WEBSHELL_Cmd_Indicator_Apr25
Repository: Neo23x0/signature-base
Detects: Detects a pattern which is often related to web shell activity
Author: Florian Roth
Reference: https://regex101.com/r/N6oZ2h/2

Pattern signatures:
$xr01 = /\.(asp|aspx|jsp|php)\?cmd=[a-z0-9%+\-\/\.]{3,20} HTTP\/1\.[01]["']? 200/

Detection condition:
1 of them

Full rule:
rule SUSP_WEBSHELL_Cmd_Indicator_Apr25 {
   meta:
      description = "Detects a pattern which is often related to web shell activity"
      reference = "https://regex101.com/r/N6oZ2h/2"
      author = "Florian Roth"
      date = "2025-04-25"
      modified = "2025-05-07"
      score = 60
   strings:
      $xr01 = /\.(asp|aspx|jsp|php)\?cmd=[a-z0-9%+\-\/\.]{3,20} HTTP\/1\.[01]["']? 200/
   condition:
      1 of them
}
YARA Detection Rule: Mimikatz_Memory_Rule_1
Repository: Neo23x0/signature-base
Detects: Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures)
Author: Florian Roth

Pattern signatures:
$s1 = "sekurlsa::wdigest" fullword ascii
      $s2 = "sekurlsa::logonPasswords" fullword ascii
      $s3 = "sekurlsa::minidump" fullword ascii
      $s4 = "sekurlsa::credman" fullword ascii

      $fp1 = "\"x_mitre_version\": " ascii
      $fp2 = "{\"type\":\"bundle\","
      $fp3 = "use strict" ascii fullword
      $fp4 = "\"url\":\"https://attack.mitre.org/" ascii

Detection condition:
1 of ($s*) and not 1 of ($fp*)

Full rule:
rule Mimikatz_Memory_Rule_1 : APT {
   meta:
      author = "Florian Roth"
      date = "2014-12-22"
      modified = "2023-07-04"
      score = 70
      nodeepdive = 1
      description = "Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures)"
      id = "55cc7129-5ea0-5545-a8f6-b5306a014dd0"
   strings:
      $s1 = "sekurlsa::wdigest" fullword ascii
      $s2 = "sekurlsa::logonPasswords" fullword ascii
      $s3 = "sekurlsa::minidump" fullword ascii
      $s4 = "sekurlsa::credman" fullword ascii

      $fp1 = "\"x_mitre_version\": " ascii
      $fp2 = "{\"type\":\"bundle\","
      $fp3 = "use strict" ascii fullword
      $fp4 = "\"url\":\"https://attack.mitre.org/" ascii
   condition:
      1 of ($s*) and not 1 of ($fp*)
}
YARA Detection Rule: Mimikatz_Memory_Rule_2
Repository: Neo23x0/signature-base
Detects: Mimikatz Rule generated from a memory dump
Author: Florian Roth (Nextron Systems) - Florian Roth
Reference: https://blog.gentilkiwi.com/mimikatz

Pattern signatures:
$s0 = "sekurlsa::" ascii
      $x1 = "cryptprimitives.pdb" ascii
      $x2 = "Now is t1O" ascii fullword
      $x4 = "ALICE123" ascii
      $x5 = "BOBBY456" ascii

Detection condition:
$s0 and 1 of ($x*)

Full rule:
rule Mimikatz_Memory_Rule_2 : APT {
   meta:
      description = "Mimikatz Rule generated from a memory dump"
      author = "Florian Roth (Nextron Systems) - Florian Roth"
      score = 75
      date = "2014-12-22"
      modified = "2023-05-19"
      reference = "https://blog.gentilkiwi.com/mimikatz"
   strings:
      $s0 = "sekurlsa::" ascii
      $x1 = "cryptprimitives.pdb" ascii
      $x2 = "Now is t1O" ascii fullword
      $x4 = "ALICE123" ascii
      $x5 = "BOBBY456" ascii
   condition:
      $s0 and 1 of ($x*)
}
YARA Detection Rule: mimikatz
Repository: Neo23x0/signature-base
Detects: mimikatz
Author: Benjamin DELPY (gentilkiwi)

Pattern signatures:
$exe_x86_1      = { 89 71 04 89 [0-3] 30 8d 04 bd }
      $exe_x86_2      = { 8b 4d e? 8b 45 f4 89 75 e? 89 01 85 ff 74 }

      $exe_x64_1      = { 33 ff 4? 89 37 4? 8b f3 45 85 c? 74}
      $exe_x64_2      = { 4c 8b df 49 [0-3] c1 e3 04 48 [0-3] 8b cb 4c 03 [0-3] d8 }

/*
      $dll_1         = { c7 0? 00 00 01 00 [4-14] c7 0? 01 00 00 00 }
      $dll_2         = { c7 0? 10 02 00 00 ?? 89 4? }
*/

      $sys_x86      = { a0 00 00 00 24 02 00 00 40 00 00 00 [0-4] b8 00 00 00 6c 02 00 00 40 00 00 00 }
      $sys_x64      = { 88 01 00 00 3c 04 00 00 40 00 00 00 [0-4] e8 02 00 00 f8 02 00 00 40 00 00 00 }

Detection condition:
(all of ($exe_x86_*)) or (all of ($exe_x64_*))
      // or (all of ($dll_*))
      or (any of ($sys_*))

Full rule:
rule mimikatz : FILE {
   meta:
      description      = "mimikatz"
      author         = "Benjamin DELPY (gentilkiwi)"
      tool_author      = "Benjamin DELPY (gentilkiwi)"
      modified = "2022-11-16"
      id = "840a5b8c-a311-50bc-a099-6b8ab1492e12"
   strings:
      $exe_x86_1      = { 89 71 04 89 [0-3] 30 8d 04 bd }
      $exe_x86_2      = { 8b 4d e? 8b 45 f4 89 75 e? 89 01 85 ff 74 }

      $exe_x64_1      = { 33 ff 4? 89 37 4? 8b f3 45 85 c? 74}
      $exe_x64_2      = { 4c 8b df 49 [0-3] c1 e3 04 48 [0-3] 8b cb 4c 03 [0-3] d8 }

/*
      $dll_1         = { c7 0? 00 00 01 00 [4-14] c7 0? 01 00 00 00 }
      $dll_2         = { c7 0? 10 02 00 00 ?? 89 4? }
*/

      $sys_x86      = { a0 00 00 00 24 02 00 00 40 00 00 00 [0-4] b8 00 00 00 6c 02 00 00 40 00 00 00 }
      $sys_x64      = { 88 01 00 00 3c 04 00 00 40 00 00 00 [0-4] e8 02 00 00 f8 02 00 00 40 00 00 00 }

   condition:
      (all of ($exe_x86_*)) or (all of ($exe_x64_*))
      // or (all of ($dll_*))
      or (any of ($sys_*))
}
YARA Detection Rule: wce
Repository: Neo23x0/signature-base
Detects: wce
Author: Benjamin DELPY (gentilkiwi)

Pattern signatures:
$hex_legacy      = { 8b ff 55 8b ec 6a 00 ff 75 0c ff 75 08 e8 [0-3] 5d c2 08 00 }
      $hex_x86      = { 8d 45 f0 50 8d 45 f8 50 8d 45 e8 50 6a 00 8d 45 fc 50 [0-8] 50 72 69 6d 61 72 79 00 }
      $hex_x64      = { ff f3 48 83 ec 30 48 8b d9 48 8d 15 [0-16] 50 72 69 6d 61 72 79 00 }

Detection condition:
any of them

Full rule:
rule wce
{
   meta:
      description      = "wce"
      author         = "Benjamin DELPY (gentilkiwi)"
      tool_author      = "Hernan Ochoa (hernano)"
      id = "857981ee-3f57-580b-8bfd-8d2109298e27"
   strings:
      $hex_legacy      = { 8b ff 55 8b ec 6a 00 ff 75 0c ff 75 08 e8 [0-3] 5d c2 08 00 }
      $hex_x86      = { 8d 45 f0 50 8d 45 f8 50 8d 45 e8 50 6a 00 8d 45 fc 50 [0-8] 50 72 69 6d 61 72 79 00 }
      $hex_x64      = { ff f3 48 83 ec 30 48 8b d9 48 8d 15 [0-16] 50 72 69 6d 61 72 79 00 }
   condition:
      any of them
}
YARA Detection Rule: power_pe_injection
Repository: Neo23x0/signature-base
Detects: PowerShell with PE Reflective Injection
Author: Benjamin DELPY (gentilkiwi)

Pattern signatures:
$str_loadlib   = "0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9"

Detection condition:
$str_loadlib

Full rule:
rule power_pe_injection
{
   meta:
      description      = "PowerShell with PE Reflective Injection"
      author         = "Benjamin DELPY (gentilkiwi)"
      id = "a71fe9f2-9c2a-5650-a5c7-116b76f10db6"
   strings:
      $str_loadlib   = "0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9"
   condition:
      $str_loadlib
}
YARA Detection Rule: Mimikatz_Logfile
Repository: Neo23x0/signature-base
Detects: Detects a log file generated by malicious hack tool mimikatz
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "SID               :" ascii fullword
      $s2 = "* NTLM     :" ascii fullword
      $s3 = "Authentication Id :" ascii fullword
      $s4 = "wdigest :" ascii fullword

Detection condition:
all of them

Full rule:
rule Mimikatz_Logfile
{
   meta:
      description = "Detects a log file generated by malicious hack tool mimikatz"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      score = 80
      date = "2015/03/31"
      id = "921d85fc-fb4d-57ed-b4ac-203d5c6f1e8e"
   strings:
      $s1 = "SID               :" ascii fullword
      $s2 = "* NTLM     :" ascii fullword
      $s3 = "Authentication Id :" ascii fullword
      $s4 = "wdigest :" ascii fullword
   condition:
      all of them
}
YARA Detection Rule: Mimikatz_Strings
Repository: Neo23x0/signature-base
Detects: Detects Mimikatz strings
Author: Florian Roth (Nextron Systems)
Reference: not set

Pattern signatures:
$x1 = "sekurlsa::logonpasswords" fullword wide ascii
      $x2 = "List tickets in MIT/Heimdall ccache" fullword ascii wide
      $x3 = "kuhl_m_kerberos_ptt_file ; LsaCallKerberosPackage %08x" fullword ascii wide
      $x4 = "* Injecting ticket :" fullword wide ascii
      $x5 = "mimidrv.sys" fullword wide ascii
      $x6 = "Lists LM & NTLM credentials" fullword wide ascii
      $x7 = "\\_ kerberos -" wide ascii
      $x8 = "* unknow   :" fullword wide ascii
      $x9 = "\\_ *Password replace ->" wide ascii
      $x10 = "KIWI_MSV1_0_PRIMARY_CREDENTIALS KO" ascii wide
      $x11 = "\\\\.\\mimidrv" wide ascii
      $x12 = "Switch to MINIDUMP :" fullword wide ascii
      $x13 = "[masterkey] with password: %s (%s user)" fullword wide
      $x14 = "Clear screen (doesn't work with redirections, like PsExec)" fullword wide
      $x15 = "** Session key is NULL! It means allowtgtsessionkey is not set to 1 **" fullword wide
      $x16 = "[masterkey] with DPAPI_SYSTEM (machine, then user): " fullw

Detection condition:
(
         ( uint16(0) == 0x5a4d and 1 of ($x*) ) or
         ( 3 of them )
      )
      /* exclude false positives */
      and not pe.imphash() == "77eaeca738dd89410a432c6bd6459907"

Full rule:
rule Mimikatz_Strings {
   meta:
      description = "Detects Mimikatz strings"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "not set"
      date = "2016-06-08"
      score = 65
      id = "d8f63b71-c66c-5c10-9268-2d8970f7c8a1"
   strings:
      $x1 = "sekurlsa::logonpasswords" fullword wide ascii
      $x2 = "List tickets in MIT/Heimdall ccache" fullword ascii wide
      $x3 = "kuhl_m_kerberos_ptt_file ; LsaCallKerberosPackage %08x" fullword ascii wide
      $x4 = "* Injecting ticket :" fullword wide ascii
      $x5 = "mimidrv.sys" fullword wide ascii
      $x6 = "Lists LM & NTLM credentials" fullword wide ascii
      $x7 = "\\_ kerberos -" wide ascii
      $x8 = "* unknow   :" fullword wide ascii
      $x9 = "\\_ *Password replace ->" wide ascii
      $x10 = "KIWI_MSV1_0_PRIMARY_CREDENTIALS KO" ascii wide
      $x11 = "\\\\.\\mimidrv" wide ascii
      $x12 = "Switch to MINIDUMP :" fullword wide ascii
      $x13 = "[masterkey] with password: %s (%s user)" fullword wide
      $x14 = "Clear screen (doesn't work with redirections, like PsExec)" fullword wide
      $x15 = "** Session key is NULL! It means allowtgtsessionkey is not set to 1 **" fullword wide
      $x16 = "[masterkey] with DPAPI_SYSTEM (machine, then user): " fullword wide
   condition:
      (
         ( uint16(0) == 0x5a4d and 1 of ($x*) ) or
         ( 3 of them )
      )
      /* exclude false positives */
      and not pe.imphash() == "77eaeca738dd89410a432c6bd6459907"
}