deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Equation_Kaspersky_GROK_Keylogger
Repository: Yara-Rules/rules
Detects: Equation Group Malware - GROK keylogger
Author: Florian Roth
Reference: http://goo.gl/ivt8EW

Pattern signatures:
$mz = { 4d 5a }
        $s0 = "c:\\users\\rmgree5\\" ascii
        $s1 = "msrtdv.sys" fullword wide
        $x1 = "svrg.pdb" fullword ascii
        $x2 = "W32pServiceTable" fullword ascii
        $x3 = "In forma" fullword ascii
        $x4 = "ReleaseF" fullword ascii
        $x5 = "criptor" fullword ascii
        $x6 = "astMutex" fullword ascii
        $x7 = "ARASATAU" fullword ascii
        $x8 = "R0omp4ar" fullword ascii
        $z1 = "H.text" fullword ascii
        $z2 = "\\registry\\machine\\software\\Microsoft\\Windows NT\\CurrentVersion" fullword wide
        $z4 = "\\registry\\machine\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment" wide fullword

Detection condition:
( $mz at 0 ) and filesize < 250000 and ($s0 or ( $s1 and 6 of ($x*) ) or ( 6 of ($x*) and all of ($z*) ))

Full rule:
rule Equation_Kaspersky_GROK_Keylogger
{

    meta:
        description = "Equation Group Malware - GROK keylogger"
        author = "Florian Roth"
        reference = "http://goo.gl/ivt8EW"
        date = "2015/02/16"
        hash = "50b8f125ed33233a545a1aac3c9d4bb6aa34b48f"

    strings:
        $mz = { 4d 5a }
        $s0 = "c:\\users\\rmgree5\\" ascii
        $s1 = "msrtdv.sys" fullword wide
        $x1 = "svrg.pdb" fullword ascii
        $x2 = "W32pServiceTable" fullword ascii
        $x3 = "In forma" fullword ascii
        $x4 = "ReleaseF" fullword ascii
        $x5 = "criptor" fullword ascii
        $x6 = "astMutex" fullword ascii
        $x7 = "ARASATAU" fullword ascii
        $x8 = "R0omp4ar" fullword ascii
        $z1 = "H.text" fullword ascii
        $z2 = "\\registry\\machine\\software\\Microsoft\\Windows NT\\CurrentVersion" fullword wide
        $z4 = "\\registry\\machine\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment" wide fullword

    condition:
        ( $mz at 0 ) and filesize < 250000 and ($s0 or ( $s1 and 6 of ($x*) ) or ( 6 of ($x*) and all of ($z*) ))
}
YARA Detection Rule: Equation_Kaspersky_GreyFishInstaller
Repository: Yara-Rules/rules
Detects: Equation Group Malware - Grey Fish
Author: Florian Roth
Reference: http://goo.gl/ivt8EW

Pattern signatures:
$s0 = "DOGROUND.exe" fullword wide
        $s1 = "Windows Configuration Services" fullword wide
        $s2 = "GetMappedFilenameW" fullword ascii

Detection condition:
all of them

Full rule:
rule Equation_Kaspersky_GreyFishInstaller
{

    meta:
        description = "Equation Group Malware - Grey Fish"
        author = "Florian Roth"
        reference = "http://goo.gl/ivt8EW"
        date = "2015/02/16"
        hash = "58d15d1581f32f36542f3e9fb4b1fc84d2a6ba35"

    strings:
        $s0 = "DOGROUND.exe" fullword wide
        $s1 = "Windows Configuration Services" fullword wide
        $s2 = "GetMappedFilenameW" fullword ascii

    condition:
        all of them
}
YARA Detection Rule: Equation_Kaspersky_EquationDrugInstaller
Repository: Yara-Rules/rules
Detects: Equation Group Malware - EquationDrug installer LUTEUSOBSTOS
Author: Florian Roth
Reference: http://goo.gl/ivt8EW

Pattern signatures:
$mz = { 4d 5a }

        $s0 = "\\system32\\win32k.sys" fullword wide
        $s1 = "ALL_FIREWALLS" fullword ascii
        $x1 = "@prkMtx" fullword wide
        $x2 = "STATIC" fullword wide
        $x3 = "windir" fullword wide
        $x4 = "cnFormVoidFBC" fullword wide
        $x5 = "CcnFormSyncExFBC" fullword wide
        $x6 = "WinStaObj" fullword wide
        $x7 = "BINRES" fullword wide

Detection condition:
( $mz at 0 ) and filesize < 500000 and all of ($s*) and 5 of ($x*)

Full rule:
rule Equation_Kaspersky_EquationDrugInstaller
{

    meta:
        description = "Equation Group Malware - EquationDrug installer LUTEUSOBSTOS"
        author = "Florian Roth"
        reference = "http://goo.gl/ivt8EW"
        date = "2015/02/16"
        hash = "61fab1b8451275c7fd580895d9c68e152ff46417"

    strings:
        $mz = { 4d 5a }

        $s0 = "\\system32\\win32k.sys" fullword wide
        $s1 = "ALL_FIREWALLS" fullword ascii
        $x1 = "@prkMtx" fullword wide
        $x2 = "STATIC" fullword wide
        $x3 = "windir" fullword wide
        $x4 = "cnFormVoidFBC" fullword wide
        $x5 = "CcnFormSyncExFBC" fullword wide
        $x6 = "WinStaObj" fullword wide
        $x7 = "BINRES" fullword wide

    condition:
        ( $mz at 0 ) and filesize < 500000 and all of ($s*) and 5 of ($x*)
}
YARA Detection Rule: Equation_Kaspersky_EquationLaserInstaller
Repository: Yara-Rules/rules
Detects: Equation Group Malware - EquationLaser Installer
Author: Florian Roth
Reference: http://goo.gl/ivt8EW

Pattern signatures:
$mz = { 4d 5a }
        $s0 = "Failed to get Windows version" fullword ascii
        $s1 = "lsasrv32.dll and lsass.exe" fullword wide
        $s2 = "\\\\%s\\mailslot\\%s" fullword ascii
        $s3 = "%d-%d-%d %d:%d:%d Z" fullword ascii
        $s4 = "lsasrv32.dll" fullword ascii
        $s5 = "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" fullword ascii
        $s6 = "%s %02x %s" fullword ascii
        $s7 = "VIEWERS" fullword ascii
        $s8 = "5.2.3790.220 (srv03_gdr[PII_REDACTED])" fullword wide

Detection condition:
( $mz at 0 ) and filesize < 250000 and 6 of ($s*)

Full rule:
rule Equation_Kaspersky_EquationLaserInstaller
{

    meta:
        description = "Equation Group Malware - EquationLaser Installer"
        author = "Florian Roth"
        reference = "http://goo.gl/ivt8EW"
        date = "2015/02/16"
        hash = "5e1f56c1e57fbff96d4999db1fd6dd0f7d8221df"

    strings:
        $mz = { 4d 5a }
        $s0 = "Failed to get Windows version" fullword ascii
        $s1 = "lsasrv32.dll and lsass.exe" fullword wide
        $s2 = "\\\\%s\\mailslot\\%s" fullword ascii
        $s3 = "%d-%d-%d %d:%d:%d Z" fullword ascii
        $s4 = "lsasrv32.dll" fullword ascii
        $s5 = "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" fullword ascii
        $s6 = "%s %02x %s" fullword ascii
        $s7 = "VIEWERS" fullword ascii
        $s8 = "5.2.3790.220 (srv03_gdr[PII_REDACTED])" fullword wide

    condition:
        ( $mz at 0 ) and filesize < 250000 and 6 of ($s*)
}
YARA Detection Rule: Equation_Kaspersky_FannyWorm
Repository: Yara-Rules/rules
Detects: Equation Group Malware - Fanny Worm
Author: Florian Roth
Reference: http://goo.gl/ivt8EW

Pattern signatures:
$mz = { 4d 5a }
        $s1 = "x:\\fanny.bmp" fullword ascii
        $s2 = "32.exe" fullword ascii
        $s3 = "d:\\fanny.bmp" fullword ascii
        $x1 = "c:\\windows\\system32\\kernel32.dll" fullword ascii
        $x2 = "System\\CurrentControlSet\\Services\\USBSTOR\\Enum" fullword ascii
        $x3 = "System\\CurrentControlSet\\Services\\PartMgr\\Enum" fullword ascii
        $x4 = "\\system32\\win32k.sys" fullword wide
        $x5 = "\\AGENTCPD.DLL" fullword ascii
        $x6 = "agentcpd.dll" fullword ascii
        $x7 = "PADupdate.exe" fullword ascii
        $x8 = "dll_installer.dll" fullword ascii
        $x9 = "\\restore\\" fullword ascii
        $x10 = "Q:\\__?__.lnk" fullword ascii
        $x11 = "Software\\Microsoft\\MSNetMng" fullword ascii
        $x12 = "\\shelldoc.dll" fullword ascii
        $x13 = "file size = %d bytes" fullword ascii
        $x14 = "\\MSAgent" fullword ascii
        $x15 = "Global\\RPCMutex" fullword ascii
        $x16 = "Global\\DirectMarketing" fullw

Detection condition:
( $mz at 0 ) and filesize < 300000 and (( 2 of ($s*) ) or ( 1 of ($s*) and 6 of ($x*) ) or ( 14 of ($x*)))

Full rule:
rule Equation_Kaspersky_FannyWorm
{

    meta:
        description = "Equation Group Malware - Fanny Worm"
        author = "Florian Roth"
        reference = "http://goo.gl/ivt8EW"
        date = "2015/02/16"
        hash = "1f0ae54ac3f10d533013f74f48849de4e65817a7"

    strings:
        $mz = { 4d 5a }
        $s1 = "x:\\fanny.bmp" fullword ascii
        $s2 = "32.exe" fullword ascii
        $s3 = "d:\\fanny.bmp" fullword ascii
        $x1 = "c:\\windows\\system32\\kernel32.dll" fullword ascii
        $x2 = "System\\CurrentControlSet\\Services\\USBSTOR\\Enum" fullword ascii
        $x3 = "System\\CurrentControlSet\\Services\\PartMgr\\Enum" fullword ascii
        $x4 = "\\system32\\win32k.sys" fullword wide
        $x5 = "\\AGENTCPD.DLL" fullword ascii
        $x6 = "agentcpd.dll" fullword ascii
        $x7 = "PADupdate.exe" fullword ascii
        $x8 = "dll_installer.dll" fullword ascii
        $x9 = "\\restore\\" fullword ascii
        $x10 = "Q:\\__?__.lnk" fullword ascii
        $x11 = "Software\\Microsoft\\MSNetMng" fullword ascii
        $x12 = "\\shelldoc.dll" fullword ascii
        $x13 = "file size = %d bytes" fullword ascii
        $x14 = "\\MSAgent" fullword ascii
        $x15 = "Global\\RPCMutex" fullword ascii
        $x16 = "Global\\DirectMarketing" fullword ascii

    condition:
        ( $mz at 0 ) and filesize < 300000 and (( 2 of ($s*) ) or ( 1 of ($s*) and 6 of ($x*) ) or ( 14 of ($x*)))
}
YARA Detection Rule: Equation_Kaspersky_HDD_reprogramming_module
Repository: Yara-Rules/rules
Detects: Equation Group Malware - HDD reprogramming module
Author: Florian Roth
Reference: http://goo.gl/ivt8EW

Pattern signatures:
$mz = { 4d 5a }
        $s0 = "nls_933w.dll" fullword ascii
        $s1 = "BINARY" fullword wide
        $s2 = "KfAcquireSpinLock" fullword ascii
        $s3 = "HAL.dll" fullword ascii
        $s4 = "READ_REGISTER_UCHAR" fullword ascii

Detection condition:
( $mz at 0 ) and filesize < 300000 and all of ($s*)

Full rule:
rule Equation_Kaspersky_HDD_reprogramming_module 
{

    meta:
        description = "Equation Group Malware - HDD reprogramming module"
        author = "Florian Roth"
        reference = "http://goo.gl/ivt8EW"
        date = "2015/02/16"
        hash = "ff2b50f371eb26f22eb8a2118e9ab0e015081500"
    
    strings:
        $mz = { 4d 5a }
        $s0 = "nls_933w.dll" fullword ascii
        $s1 = "BINARY" fullword wide
        $s2 = "KfAcquireSpinLock" fullword ascii
        $s3 = "HAL.dll" fullword ascii
        $s4 = "READ_REGISTER_UCHAR" fullword ascii
    condition:
        ( $mz at 0 ) and filesize < 300000 and all of ($s*)
}
YARA Detection Rule: Equation_Kaspersky_EOP_Package
Repository: Yara-Rules/rules
Detects: Equation Group Malware - EoP package and malware launcher
Author: Florian Roth
Reference: http://goo.gl/ivt8EW

Pattern signatures:
$mz = { 4d 5a }
        $s0 = "abababababab" fullword ascii
        $s1 = "abcdefghijklmnopq" fullword ascii
        $s2 = "@STATIC" fullword wide
        $s3 = "$aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" fullword ascii
        $s4 = "@prkMtx" fullword wide
        $s5 = "prkMtx" fullword wide
        $s6 = "cnFormVoidFBC" fullword wide

Detection condition:
( $mz at 0 ) and filesize < 100000 and all of ($s*)

Full rule:
rule Equation_Kaspersky_EOP_Package 
{

    meta:
        description = "Equation Group Malware - EoP package and malware launcher"
        author = "Florian Roth"
        reference = "http://goo.gl/ivt8EW"
        date = "2015/02/16"
        hash = "2bd1b1f5b4384ce802d5d32d8c8fd3d1dc04b962"

    strings:
        $mz = { 4d 5a }
        $s0 = "abababababab" fullword ascii
        $s1 = "abcdefghijklmnopq" fullword ascii
        $s2 = "@STATIC" fullword wide
        $s3 = "$aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" fullword ascii
        $s4 = "@prkMtx" fullword wide
        $s5 = "prkMtx" fullword wide
        $s6 = "cnFormVoidFBC" fullword wide

    condition:
        ( $mz at 0 ) and filesize < 100000 and all of ($s*)
}
YARA Detection Rule: Equation_Kaspersky_TripleFantasy_Loader
Repository: Yara-Rules/rules
Detects: Equation Group Malware - TripleFantasy Loader
Author: Florian Roth
Reference: http://goo.gl/ivt8EW

Pattern signatures:
$mz = { 4d 5a }
        $x1 = "Original Innovations, LLC" fullword wide
        $x2 = "Moniter Resource Protocol" fullword wide
        $x3 = "ahlhcib.dll" fullword wide
        $s0 = "hnetcfg.HNetGetSharingServicesPage" fullword ascii
        $s1 = "hnetcfg.IcfGetOperationalMode" fullword ascii
        $s2 = "hnetcfg.IcfGetDynamicFwPorts" fullword ascii
        $s3 = "hnetcfg.HNetFreeFirewallLoggingSettings" fullword ascii
        $s4 = "hnetcfg.HNetGetShareAndBridgeSettings" fullword ascii
        $s5 = "hnetcfg.HNetGetFirewallSettingsPage" fullword ascii

Detection condition:
( $mz at 0 ) and filesize < 50000 and ( all of ($x*) and all of ($s*) )

Full rule:
rule Equation_Kaspersky_TripleFantasy_Loader 
{

    meta:
        description = "Equation Group Malware - TripleFantasy Loader"
        author = "Florian Roth"
        reference = "http://goo.gl/ivt8EW"
        date = "2015/02/16"
        hash = "4ce6e77a11b443cc7cbe439b71bf39a39d3d7fa3"
    
    strings:
        $mz = { 4d 5a }
        $x1 = "Original Innovations, LLC" fullword wide
        $x2 = "Moniter Resource Protocol" fullword wide
        $x3 = "ahlhcib.dll" fullword wide
        $s0 = "hnetcfg.HNetGetSharingServicesPage" fullword ascii
        $s1 = "hnetcfg.IcfGetOperationalMode" fullword ascii
        $s2 = "hnetcfg.IcfGetDynamicFwPorts" fullword ascii
        $s3 = "hnetcfg.HNetFreeFirewallLoggingSettings" fullword ascii
        $s4 = "hnetcfg.HNetGetShareAndBridgeSettings" fullword ascii
        $s5 = "hnetcfg.HNetGetFirewallSettingsPage" fullword ascii
    
    condition:
        ( $mz at 0 ) and filesize < 50000 and ( all of ($x*) and all of ($s*) )
}
YARA Detection Rule: Equation_Kaspersky_SuspiciousString
Repository: Yara-Rules/rules
Detects: Equation Group Malware - suspicious string found in sample
Author: Florian Roth
Reference: http://goo.gl/ivt8EW

Pattern signatures:
$mz = { 4d 5a }
        $s1 = "i386\\DesertWinterDriver.pdb" fullword
        $s2 = "Performing UR-specific post-install..."
        $s3 = "Timeout waiting for the \"canInstallNow\" event from the implant-specific EXE!"
        $s4 = "STRAITSHOOTER30.exe"
        $s5 = "standalonegrok_2.1.1.1"
        $s6 = "c:\\users\\rmgree5\\"

Detection condition:
( $mz at 0 ) and filesize < 500000 and all of ($s*)

Full rule:
rule Equation_Kaspersky_SuspiciousString 
{
  
    meta:
        description = "Equation Group Malware - suspicious string found in sample"
        author = "Florian Roth"
        reference = "http://goo.gl/ivt8EW"
        date = "2015/02/17"
        score = 60
   
    strings:
        $mz = { 4d 5a }
        $s1 = "i386\\DesertWinterDriver.pdb" fullword
        $s2 = "Performing UR-specific post-install..."
        $s3 = "Timeout waiting for the \"canInstallNow\" event from the implant-specific EXE!"
        $s4 = "STRAITSHOOTER30.exe"
        $s5 = "standalonegrok_2.1.1.1"
        $s6 = "c:\\users\\rmgree5\\"
    
    condition:
        ( $mz at 0 ) and filesize < 500000 and all of ($s*)
}
YARA Detection Rule: EquationDrug_NetworkSniffer1
Repository: Yara-Rules/rules
Detects: EquationDrug - Backdoor driven by network sniffer - mstcp32.sys, fat32.sys
Author: Florian Roth @4nc4p
Reference: http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/

Pattern signatures:
$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
        $s1 = "\\Registry\\User\\CurrentUser\\" fullword wide
        $s3 = "sys\\mstcp32.dbg" fullword ascii
        $s7 = "mstcp32.sys" fullword wide
        $s8 = "p32.sys" fullword ascii
        $s9 = "\\Device\\%ws_%ws" fullword wide
        $s10 = "\\DosDevices\\%ws" fullword wide
        $s11 = "\\Device\\%ws" fullword wide

Detection condition:
all of them

Full rule:
rule EquationDrug_NetworkSniffer1
{

    meta:
        description = "EquationDrug - Backdoor driven by network sniffer - mstcp32.sys, fat32.sys"
        author = "Florian Roth @4nc4p"
        reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
        date = "2015/03/11"
        hash = "26e787997a338d8111d96c9a4c103cf8ff0201ce"

    strings:
        $s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
        $s1 = "\\Registry\\User\\CurrentUser\\" fullword wide
        $s3 = "sys\\mstcp32.dbg" fullword ascii
        $s7 = "mstcp32.sys" fullword wide
        $s8 = "p32.sys" fullword ascii
        $s9 = "\\Device\\%ws_%ws" fullword wide
        $s10 = "\\DosDevices\\%ws" fullword wide
        $s11 = "\\Device\\%ws" fullword wide
    
    condition:
        all of them
}
YARA Detection Rule: EquationDrug_CompatLayer_UnilayDLL
Repository: Yara-Rules/rules
Detects: EquationDrug - Unilay.DLL
Author: Florian Roth @4nc4p
Reference: http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/

Pattern signatures:
$mz = { 4d 5a }
        $s0 = "unilay.dll" fullword ascii

Detection condition:
( $mz at 0 ) and $s0

Full rule:
rule EquationDrug_CompatLayer_UnilayDLL 
{

    meta:
        description = "EquationDrug - Unilay.DLL"
        author = "Florian Roth @4nc4p"
        reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
        date = "2015/03/11"
        hash = "a3a31937956f161beba8acac35b96cb74241cd0f"

    strings:
        $mz = { 4d 5a }
        $s0 = "unilay.dll" fullword ascii

    condition:
        ( $mz at 0 ) and $s0
}
YARA Detection Rule: EquationDrug_HDDSSD_Op
Repository: Yara-Rules/rules
Detects: EquationDrug - HDD/SSD firmware operation - nls_933w.dll
Author: Florian Roth @4nc4p
Reference: http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/

Pattern signatures:
$s0 = "nls_933w.dll" fullword ascii

Detection condition:
all of them

Full rule:
rule EquationDrug_HDDSSD_Op 
{

    meta:
        description = "EquationDrug - HDD/SSD firmware operation - nls_933w.dll"
        author = "Florian Roth @4nc4p"
        reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
        date = "2015/03/11"
        hash = "ff2b50f371eb26f22eb8a2118e9ab0e015081500"

    strings:
        $s0 = "nls_933w.dll" fullword ascii

    condition:
        all of them
}
YARA Detection Rule: EquationDrug_NetworkSniffer2
Repository: Yara-Rules/rules
Detects: EquationDrug - Network Sniffer - tdip.sys
Author: Florian Roth @4nc4p
Reference: http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/

Pattern signatures:
$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
        $s1 = "IP Transport Driver" fullword wide
        $s2 = "tdip.sys" fullword wide
        $s3 = "sys\\tdip.dbg" fullword ascii
        $s4 = "dip.sys" fullword ascii
        $s5 = "\\Device\\%ws_%ws" fullword wide
        $s6 = "\\DosDevices\\%ws" fullword wide
        $s7 = "\\Device\\%ws" fullword wide

Detection condition:
all of them

Full rule:
rule EquationDrug_NetworkSniffer2 
{

    meta:
        description = "EquationDrug - Network Sniffer - tdip.sys"
        author = "Florian Roth @4nc4p"
        reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
        date = "2015/03/11"
        hash = "7e3cd36875c0e5ccb076eb74855d627ae8d4627f"

    strings:
        $s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
        $s1 = "IP Transport Driver" fullword wide
        $s2 = "tdip.sys" fullword wide
        $s3 = "sys\\tdip.dbg" fullword ascii
        $s4 = "dip.sys" fullword ascii
        $s5 = "\\Device\\%ws_%ws" fullword wide
        $s6 = "\\DosDevices\\%ws" fullword wide
        $s7 = "\\Device\\%ws" fullword wide

    condition:
        all of them
}
YARA Detection Rule: EquationDrug_NetworkSniffer3
Repository: Yara-Rules/rules
Detects: EquationDrug - Network Sniffer - tdip.sys
Author: Florian Roth @4nc4p
Reference: http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/

Pattern signatures:
$s0 = "Corporation. All rights reserved." fullword wide
        $s1 = "IP Transport Driver" fullword wide
        $s2 = "tdip.sys" fullword wide
        $s3 = "tdip.pdb" fullword ascii

Detection condition:
all of them

Full rule:
rule EquationDrug_NetworkSniffer3 
{

    meta:
        description = "EquationDrug - Network Sniffer - tdip.sys"
        author = "Florian Roth @4nc4p"
        reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
        date = "2015/03/11"
        hash = "[PII_REDACTED]a9646cd978cf962c4f[PII_REDACTED]0"

    strings:
        $s0 = "Corporation. All rights reserved." fullword wide
        $s1 = "IP Transport Driver" fullword wide
        $s2 = "tdip.sys" fullword wide
        $s3 = "tdip.pdb" fullword ascii

    condition:
        all of them
}
YARA Detection Rule: EquationDrug_VolRec_Driver
Repository: Yara-Rules/rules
Detects: EquationDrug - Collector plugin for Volrec - msrstd.sys
Author: Florian Roth @4nc4p
Reference: http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/

Pattern signatures:
$s0 = "msrstd.sys" fullword wide
        $s1 = "msrstd.pdb" fullword ascii
        $s2 = "msrstd driver" fullword wide

Detection condition:
all of them

Full rule:
rule EquationDrug_VolRec_Driver 
{

    meta:
        description = "EquationDrug - Collector plugin for Volrec - msrstd.sys"
        author = "Florian Roth @4nc4p"
        reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
        date = "2015/03/11"
        hash = "ee2b504ad502dc3fed62d6483d93d9b1221cdd6c"

    strings:
        $s0 = "msrstd.sys" fullword wide
        $s1 = "msrstd.pdb" fullword ascii
        $s2 = "msrstd driver" fullword wide

    condition:
        all of them
}
YARA Detection Rule: EquationDrug_KernelRootkit
Repository: Yara-Rules/rules
Detects: EquationDrug - Kernel mode stage 0 and rootkit (Windows 2000 and above) - msndsrv.sys
Author: Florian Roth @4nc4p
Reference: http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/

Pattern signatures:
$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
        $s1 = "Parmsndsrv.dbg" fullword ascii
        $s2 = "\\Registry\\User\\CurrentUser\\" fullword wide
        $s3 = "msndsrv.sys" fullword wide
        $s5 = "\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Control\\Windows" fullword wide
        $s6 = "\\Device\\%ws_%ws" fullword wide
        $s7 = "\\DosDevices\\%ws" fullword wide
        $s9 = "\\Device\\%ws" fullword wide

Detection condition:
all of them

Full rule:
rule EquationDrug_KernelRootkit 
{

    meta:
        description = "EquationDrug - Kernel mode stage 0 and rootkit (Windows 2000 and above) - msndsrv.sys"
        author = "Florian Roth @4nc4p"
        reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
        date = "2015/03/11"
        hash = "[PII_REDACTED]49e9fb77dc733b2e4d507f0cc41af6"

    strings:
        $s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
        $s1 = "Parmsndsrv.dbg" fullword ascii
        $s2 = "\\Registry\\User\\CurrentUser\\" fullword wide
        $s3 = "msndsrv.sys" fullword wide
        $s5 = "\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Control\\Windows" fullword wide
        $s6 = "\\Device\\%ws_%ws" fullword wide
        $s7 = "\\DosDevices\\%ws" fullword wide
        $s9 = "\\Device\\%ws" fullword wide

    condition:
        all of them
}