deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Susp_Indicators_EXE
Repository: Neo23x0/signature-base
Detects: Detects packed NullSoft Inst EXE with characteristics of NetWire RAT
Author: Florian Roth (Nextron Systems)
Reference: https://pastebin.com/8qaiyPxs

Pattern signatures:
$s1 = "Software\\Microsoft\\Windows\\CurrentVersion"
      $s2 = "Error! Bad token or internal error" fullword ascii
      $s3 = "CRYPTBASE" fullword ascii
      $s4 = "UXTHEME" fullword ascii
      $s5 = "PROPSYS" fullword ascii
      $s6 = "APPHELP" fullword ascii

Detection condition:
uint16(0) == 0x5A4D and uint32(uint32(0x3c)) == 0x4550 and filesize < 700KB and all of them

Full rule:
rule Susp_Indicators_EXE {
   meta:
      description = "Detects packed NullSoft Inst EXE with characteristics of NetWire RAT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://pastebin.com/8qaiyPxs"
      date = "2018-01-05"
      score = 60
      hash1 = "6de7f0276afa633044c375c5c630740af51e29b6a6f17a64fbdd227c641727a4"
      id = "b4015c24-d18e-51eb-9854-8cc0e6dba4d0"
   strings:
      $s1 = "Software\\Microsoft\\Windows\\CurrentVersion"
      $s2 = "Error! Bad token or internal error" fullword ascii
      $s3 = "CRYPTBASE" fullword ascii
      $s4 = "UXTHEME" fullword ascii
      $s5 = "PROPSYS" fullword ascii
      $s6 = "APPHELP" fullword ascii
   condition:
   uint16(0) == 0x5A4D and uint32(uint32(0x3c)) == 0x4550 and filesize < 700KB and all of them
}
YARA Detection Rule: Suspicious_BAT_Strings
Repository: Neo23x0/signature-base
Detects: Detects a string also used in Netwire RAT auxilliary
Author: Florian Roth (Nextron Systems)
Reference: https://pastebin.com/8qaiyPxs

Pattern signatures:
$s1 = "ping 192.0.2.2 -n 1" ascii

Detection condition:
filesize < 600KB and 1 of them

Full rule:
rule Suspicious_BAT_Strings {
   meta:
      description = "Detects a string also used in Netwire RAT auxilliary"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      score = 60
      reference = "https://pastebin.com/8qaiyPxs"
      date = "2018-01-05"
      id = "5fe28555-96c8-54da-b047-7d0a7532a6d2"
   strings:
      $s1 = "ping 192.0.2.2 -n 1" ascii
   condition:
      filesize < 600KB and 1 of them
}
YARA Detection Rule: Malicious_BAT_Strings
Repository: Neo23x0/signature-base
Detects: Detects a string also used in Netwire RAT auxilliary
Author: Florian Roth (Nextron Systems)
Reference: https://pastebin.com/8qaiyPxs

Pattern signatures:
$s1 = "call :deleteSelf&exit /b"

Detection condition:
filesize < 600KB and 1 of them

Full rule:
rule Malicious_BAT_Strings {
   meta:
      description = "Detects a string also used in Netwire RAT auxilliary"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      score = 60
      reference = "https://pastebin.com/8qaiyPxs"
      date = "2018-01-05"
      id = "6e197d05-62eb-535d-8cd6-db8550e51588"
   strings:
      $s1 = "call :deleteSelf&exit /b"
   condition:
      filesize < 600KB and 1 of them
}
YARA Detection Rule: GoldenEye_Ransomware_XLS
Repository: Neo23x0/signature-base
Detects: GoldenEye XLS with Macro - file Schneider-Bewerbung.xls
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/jp2SkT

Pattern signatures:
$x1 = "fso.GetTempName();tmp_path = tmp_path.replace('.tmp', '.exe')" fullword ascii
      $x2 = "var shell = new ActiveXObject('WScript.Shell');shell.run(t'" fullword ascii

Detection condition:
( uint16(0) == 0xcfd0 and filesize < 4000KB and 1 of them )

Full rule:
rule GoldenEye_Ransomware_XLS {
   meta:
      description = "GoldenEye XLS with Macro - file Schneider-Bewerbung.xls"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/jp2SkT"
      date = "2016-12-06"
      hash1 = "2320d4232ee80cc90bacd768ba52374a21d0773c39895b88cdcaa7782e16c441"
      id = "6eafcc35-56ef-534f-884a-0bb47c27c274"
   strings:
      $x1 = "fso.GetTempName();tmp_path = tmp_path.replace('.tmp', '.exe')" fullword ascii
      $x2 = "var shell = new ActiveXObject('WScript.Shell');shell.run(t'" fullword ascii
   condition:
      ( uint16(0) == 0xcfd0 and filesize < 4000KB and 1 of them )
}
YARA Detection Rule: GoldenEyeRansomware_Dropper_MalformedZoomit
Repository: Neo23x0/signature-base
Detects: Auto-generated rule
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/jp2SkT

Pattern signatures:
$s1 = "ZoomIt - Sysinternals: www.sysinternals.com" fullword ascii
      $n1 = "Mark Russinovich" wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 800KB and $s1 and not $n1 )

Full rule:
rule GoldenEyeRansomware_Dropper_MalformedZoomit {
   meta:
      description = "Auto-generated rule"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/jp2SkT"
      date = "2016-12-06"
      hash1 = "b5ef16922e2c76b09edd71471dd837e89811c5e658406a8495c1364d0d9dc690"
      id = "6ebf2d13-7d58-5a1b-a836-66d533f408e8"
   strings:
      $s1 = "ZoomIt - Sysinternals: www.sysinternals.com" fullword ascii
      $n1 = "Mark Russinovich" wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 800KB and $s1 and not $n1 )
}
YARA Detection Rule: SharpCat
Repository: Neo23x0/signature-base
Detects: Detects command shell SharpCat - file SharpCat.exe
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/Cn33liz/SharpCat

Pattern signatures:
$x1 = "ShellZz" fullword ascii
		$s2 = "C:\\Windows\\System32\\cmd.exe" fullword wide
		$s3 = "currentDirectory" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 20KB and all of them

Full rule:
rule SharpCat {
	meta:
		description = "Detects command shell SharpCat - file SharpCat.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/Cn33liz/SharpCat"
		date = "2016-06-10"
		hash1 = "96dcdf68b06c3609f486f9d560661f4fec9fe329e78bd300ad3e2a9f07e332e9"
		id = "94a7ce40-ac2f-598e-86c5-ee9fde1eeef0"
	strings:
		$x1 = "ShellZz" fullword ascii
		$s2 = "C:\\Windows\\System32\\cmd.exe" fullword wide
		$s3 = "currentDirectory" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 20KB and all of them
}
YARA Detection Rule: VUL_Exchange_CVE_2020_0688
Repository: Neo23x0/signature-base
Detects: Detects static validation key used by Exchange server in web.config
Author: Florian Roth (Nextron Systems)
Reference: https://www.thezdi.com/blog/2020/2/24/cve-2020-0688-remote-code-execution-on-microsoft-exchange-server-through-fixed-cryptographic-keys

Pattern signatures:
$h1 = "<?xml "
      $x1 = "<machineKey validationKey=\"CB2721ABDAF8E9DC516D621D8B8BF13A2C9E8689A25303BF\"" ascii wide

Detection condition:
filesize <= 300KB and $h1 at 0 and $x1

Full rule:
rule VUL_Exchange_CVE_2020_0688 {
   meta:
      description = "Detects static validation key used by Exchange server in web.config"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.thezdi.com/blog/2020/2/24/cve-2020-0688-remote-code-execution-on-microsoft-exchange-server-through-fixed-cryptographic-keys"
      date = "2020-02-26"
      score = 60
      id = "1065f297-0dc4-5dcb-b0f3-c89d06ff5e69"
   strings:
      $h1 = "<?xml "
      $x1 = "<machineKey validationKey=\"CB2721ABDAF8E9DC516D621D8B8BF13A2C9E8689A25303BF\"" ascii wide
   condition:
      filesize <= 300KB and $h1 at 0 and $x1
}
YARA Detection Rule: SUSP_BAT_OBFUSC_Jul24_1
Repository: Neo23x0/signature-base
Detects: Detects indicators of obfuscation in Windows Batch files
Author: Florian Roth
Reference: https://x.com/0xToxin/status/[PII_REDACTED]43752045

Pattern signatures:
$s1 = "&&set "

Detection condition:
filesize < 300KB  
      and uint32(0) == 0x20746573 // "set " at the beginning of the file
      and $s1 in (0..32) // "&&set " in the first 32 bytes

Full rule:
rule SUSP_BAT_OBFUSC_Jul24_1 {
   meta:
      description = "Detects indicators of obfuscation in Windows Batch files"
      author = "Florian Roth"
      reference = "https://x.com/0xToxin/status/[PII_REDACTED]43752045"
      date = "2024-07-12"
      score = 70
      id = "801e7efc-2c31-5590-afcd-9e11072c9c65"
   strings:
      $s1 = "&&set "
   condition:
      filesize < 300KB  
      and uint32(0) == 0x20746573 // "set " at the beginning of the file
      and $s1 in (0..32) // "&&set " in the first 32 bytes
}
YARA Detection Rule: SUSP_BAT_OBFUSC_Jul24_2
Repository: Neo23x0/signature-base
Detects: Detects indicators of obfuscation in Windows Batch files
Author: Florian Roth
Reference: https://x.com/0xToxin/status/[PII_REDACTED]43752045

Pattern signatures:
$s1 = "&&set "

Detection condition:
filesize < 300KB
      // number of occurrences of the string "&&set " in the file
      and #s1 > 30
      // it's the "%\n" at the very end of the file
      and uint16(filesize-2) == 0x0a0d
      and uint8(filesize-3) == 0x25

Full rule:
rule SUSP_BAT_OBFUSC_Jul24_2 {
   meta:
      description = "Detects indicators of obfuscation in Windows Batch files"
      author = "Florian Roth"
      reference = "https://x.com/0xToxin/status/[PII_REDACTED]43752045"
      date = "2024-07-12"
      score = 70
      id = "999cd365-2862-5618-b0b6-ee45dea1e9cf"
   strings:
      $s1 = "&&set "
   condition:
      filesize < 300KB
      // number of occurrences of the string "&&set " in the file
      and #s1 > 30
      // it's the "%\n" at the very end of the file
      and uint16(filesize-2) == 0x0a0d
      and uint8(filesize-3) == 0x25
}
YARA Detection Rule: SUSP_BAT_OBFUSC_Jul24_3
Repository: Neo23x0/signature-base
Detects: Detects indicators of obfuscation in Windows Batch files
Author: Florian Roth
Reference: https://x.com/0xToxin/status/[PII_REDACTED]43752045

Pattern signatures:
$s1 = "% \\\\%" // part of the UNC path for the SMB connection
      // It detects the set pattern with a single character value in front of the %%
      // we use ?? to wildcard the character
      // =?&&set 
      $s2 = { 3D ?? 26 26 73 65 74 20 }

Detection condition:
filesize < 300KB
      and all of them

Full rule:
rule SUSP_BAT_OBFUSC_Jul24_3 {
   meta:
      description = "Detects indicators of obfuscation in Windows Batch files"
      author = "Florian Roth"
      reference = "https://x.com/0xToxin/status/[PII_REDACTED]43752045"
      date = "2024-07-12"
      score = 70
      id = "a484ed03-8588-55e7-9674-b1208e14eb3f"
   strings:
      $s1 = "% \\\\%" // part of the UNC path for the SMB connection
      // It detects the set pattern with a single character value in front of the %%
      // we use ?? to wildcard the character
      // =?&&set 
      $s2 = { 3D ?? 26 26 73 65 74 20 } 
   condition:
      filesize < 300KB
      and all of them
}
YARA Detection Rule: EXT_APT32_goopdate_installer
Repository: Neo23x0/signature-base
Detects: Detects APT32 installer side-loaded with goopdate.dll
Author: Facebook
Reference: https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam/

Pattern signatures:
$s0 = { 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 33 05 ?? ?? ?? ?? }
    $s1 = "GetProcAddress"
    $s2 = { 8B 4D FC ?? ?? 0F B6 51 0C ?? ?? 8B 4D F0 0F B6 1C 01 33 DA }
    $s3 = "FindNextFileW"
    $s4 = "Process32NextW"

Detection condition:
(pe.is_64bit() or pe.is_32bit()) and
    all of them

Full rule:
rule EXT_APT32_goopdate_installer {
  meta:
    reference = "https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam/"
    author = "Facebook"
    description = "Detects APT32 installer side-loaded with goopdate.dll"
    sample = "69730f2c2bb9668a17f8dfa1f1523e0e1e997ba98f027ce98f5cbaa869347383"
    id = "08f3cbda-ccb7-517a-b205-5f71de26c735"
  strings:
    $s0 = { 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 33 05 ?? ?? ?? ?? }
    $s1 = "GetProcAddress"
    $s2 = { 8B 4D FC ?? ?? 0F B6 51 0C ?? ?? 8B 4D F0 0F B6 1C 01 33 DA }
    $s3 = "FindNextFileW"
    $s4 = "Process32NextW"

  condition:
    (pe.is_64bit() or pe.is_32bit()) and
    all of them
}
YARA Detection Rule: EXT_APT32_osx_backdoor_loader
Repository: Neo23x0/signature-base
Detects: Detects APT32 backdoor loader on OSX
Author: Facebook
Reference: https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam/

Pattern signatures:
$a1 = { 00 D2 44 8A 04 0F 44 88 C0 C0 E8 07 08 D0 88 44 0F FF 48 FF C1 48 83 F9 10 44 88 C2 }
    $a2 = { 41 0F 10 04 07 0F 57 84 05 A0 FE FF FF 41 0F 11 04 07 48 83 C0 10 48 83 F8 10 75 }

    // Encrypted data
    $e1 = { CA CF 3E F2 DA 43 E6 D1  D5 6C D4 23 3A AE F1 B2 } // Decoded to drop filepath: '/tmp/panels'
    $e2 = "MlkHVdRbOkra9s+G65MAoLga340t3+zj/u8LPfP3hig=" // Decoded to export API name 'ArchaeologistCodeine'
    $e3 = { 5A 69 98 0E 6C 4B 5C 69  7E 19 34 3B C3 07 CA 13 } // Decoded to 'ifconfig -l'
    $e4 = "1Sib4HfPuRQjpxIpECnxxTPiu3FXOFAHMx/+9MEVv9M+h1ngV7T5WUP3b0zsg0Qd" // Decoded to export API 'PlayerAberadurtheIncomprehensible'

    // Decoded export func names
    $e5 = "_ArchaeologistCodeine"
    $e6 = "_PlayerAberadurtheIncomprehensible"

Detection condition:
((uint32(0) == 0xfeedface or uint32be(0) == 0xfeedface) or (uint32(0) == 0xfeedfacf or uint32be(0) == 0xfeedfacf)) and
   (
      2 of ($e*) or
      all of ($a*)
   )

Full rule:
rule EXT_APT32_osx_backdoor_loader {
  meta:
    reference = "https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam/"
    author = "Facebook"
    description = "Detects APT32 backdoor loader on OSX"
    sample = "768510fa9eb807bba9c3dcb3c7f87b771e20fa3d81247539e9ea4349205e39eb"
    id = "ac313bd8-bf15-5b72-b651-35015f71dd90"
  strings:
    $a1 = { 00 D2 44 8A 04 0F 44 88 C0 C0 E8 07 08 D0 88 44 0F FF 48 FF C1 48 83 F9 10 44 88 C2 }
    $a2 = { 41 0F 10 04 07 0F 57 84 05 A0 FE FF FF 41 0F 11 04 07 48 83 C0 10 48 83 F8 10 75 }

    // Encrypted data
    $e1 = { CA CF 3E F2 DA 43 E6 D1  D5 6C D4 23 3A AE F1 B2 } // Decoded to drop filepath: '/tmp/panels'
    $e2 = "MlkHVdRbOkra9s+G65MAoLga340t3+zj/u8LPfP3hig=" // Decoded to export API name 'ArchaeologistCodeine'
    $e3 = { 5A 69 98 0E 6C 4B 5C 69  7E 19 34 3B C3 07 CA 13 } // Decoded to 'ifconfig -l'
    $e4 = "1Sib4HfPuRQjpxIpECnxxTPiu3FXOFAHMx/+9MEVv9M+h1ngV7T5WUP3b0zsg0Qd" // Decoded to export API 'PlayerAberadurtheIncomprehensible'

    // Decoded export func names
    $e5 = "_ArchaeologistCodeine"
    $e6 = "_PlayerAberadurtheIncomprehensible"

  condition:
    ((uint32(0) == 0xfeedface or uint32be(0) == 0xfeedface) or (uint32(0) == 0xfeedfacf or uint32be(0) == 0xfeedfacf)) and
   (
      2 of ($e*) or
      all of ($a*)
   )
}
YARA Detection Rule: Unspecified_Malware_Sep1_A1
Repository: Neo23x0/signature-base
Detects: Detects malware from DrqgonFly APT report
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group

Detection condition:
( uint16(0) == 0x5a4d and
        filesize < 200KB and
        pe.imphash() == "17a4bd9c95f2898add97f309fc6f9bcd"
      )

Full rule:
rule Unspecified_Malware_Sep1_A1 {
   meta:
      description = "Detects malware from DrqgonFly APT report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
      date = "2017-09-12"
      hash1 = "28143c7638f22342bff8edcd0bedd708e265948a5fcca750c302e2dca95ed9f0"
      id = "cff49e85-c8c3-5240-9948-0551e38e7040"
   condition:
      ( uint16(0) == 0x5a4d and
        filesize < 200KB and
        pe.imphash() == "17a4bd9c95f2898add97f309fc6f9bcd"
      )
}
YARA Detection Rule: DragonFly_APT_Sep17_1
Repository: Neo23x0/signature-base
Detects: Detects malware from DrqgonFly APT report
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group

Pattern signatures:
$s1 = "\\Update\\Temp\\ufiles.txt" wide
      $s2 = "%02d.%02d.%04d %02d:%02d" fullword wide
      $s3 = "*pass*.*" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and all of them )

Full rule:
rule DragonFly_APT_Sep17_1 {
   meta:
      description = "Detects malware from DrqgonFly APT report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
      date = "2017-09-12"
      hash1 = "fc54d8afd2ce5cb6cc53c46783bf91d0dd19de604308d[PII_REDACTED]26bc36ed9"
      id = "d219a54e-cb76-5c56-b64c-5019e811eeb1"
   strings:
      $s1 = "\\Update\\Temp\\ufiles.txt" wide
      $s2 = "%02d.%02d.%04d %02d:%02d" fullword wide
      $s3 = "*pass*.*" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and all of them )
}
YARA Detection Rule: DragonFly_APT_Sep17_2
Repository: Neo23x0/signature-base
Detects: Detects malware from DrqgonFly APT report
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group

Pattern signatures:
$s1 = "\\AppData\\Roaming\\Opera Software\\Opera Stable\\Login Data" wide
      $s2 = "C:\\Users\\Public\\Log.txt" fullword wide
      $s3 = "SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins" fullword wide
      $s4 = "***************** Mozilla Firefox ****************" fullword wide
      $s5 = "********************** Opera *********************" fullword wide
      $s6 = "\\AppData\\Local\\Microsoft\\Credentials\\" wide
      $s7 = "\\Appdata\\Local\\Google\\Chrome\\User Data\\Default\\" wide
      $s8 = "**************** Internet Explorer ***************" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 3000KB and 3 of them )

Full rule:
rule DragonFly_APT_Sep17_2 {
   meta:
      description = "Detects malware from DrqgonFly APT report"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
      date = "2017-09-12"
      modified = "2023-01-06"
      hash1 = "178348c14324bc0a3e57559a01a6ae6aa0cb4013aabbe324b51f906dcf5d537e"
      id = "e64f121d-a628-54b5-88f3-96eea388c155"
   strings:
      $s1 = "\\AppData\\Roaming\\Opera Software\\Opera Stable\\Login Data" wide
      $s2 = "C:\\Users\\Public\\Log.txt" fullword wide
      $s3 = "SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins" fullword wide
      $s4 = "***************** Mozilla Firefox ****************" fullword wide
      $s5 = "********************** Opera *********************" fullword wide
      $s6 = "\\AppData\\Local\\Microsoft\\Credentials\\" wide
      $s7 = "\\Appdata\\Local\\Google\\Chrome\\User Data\\Default\\" wide
      $s8 = "**************** Internet Explorer ***************" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 3000KB and 3 of them )
}
YARA Detection Rule: DragonFly_APT_Sep17_3
Repository: Neo23x0/signature-base
Detects: Detects malware from DrqgonFly APT report
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group

Pattern signatures:
$s1 = "kernel64.dll" fullword ascii
      $s2 = "ws2_32.dQH" fullword ascii
      $s3 = "HGFEDCBADCBA" fullword ascii
      $s4 = "AWAVAUATWVSU" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and
        filesize < 40KB and (
           pe.imphash() == "6f03fb864ff388bac8680ac5303584be" or
           all of them
        )
      )

Full rule:
rule DragonFly_APT_Sep17_3 {
   meta:
      description = "Detects malware from DrqgonFly APT report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
      date = "2017-09-12"
      hash1 = "b051a5997267a5d7fa[PII_REDACTED]f[PII_REDACTED]ab2b25b037086e2e971564291"
      id = "4eafd732-80bc-5f50-bf0d-096df4d35d61"
   strings:
      $s1 = "kernel64.dll" fullword ascii
      $s2 = "ws2_32.dQH" fullword ascii
      $s3 = "HGFEDCBADCBA" fullword ascii
      $s4 = "AWAVAUATWVSU" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and
        filesize < 40KB and (
           pe.imphash() == "6f03fb864ff388bac8680ac5303584be" or
           all of them
        )
      )
}
YARA Detection Rule: DragonFly_APT_Sep17_4
Repository: Neo23x0/signature-base
Detects: Detects malware from DrqgonFly APT report
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group

Pattern signatures:
$s1 = "screen.exe" fullword wide
      $s2 = "PlatformInvokeUSER32" fullword ascii
      $s3 = "GetDesktopImageF" fullword ascii
      $s4 = "PlatformInvokeGDI32" fullword ascii
      $s5 = "GetDesktopImage" fullword ascii
      $s6 = "Too many arguments, going to store in current dir" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 60KB and all of them )

Full rule:
rule DragonFly_APT_Sep17_4 {
   meta:
      description = "Detects malware from DrqgonFly APT report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
      date = "2017-09-12"
      hash1 = "2f159b71183a69928ba8f26b76772ec504aefeac71021b012bd006162e133731"
      id = "dbc0eebf-fc81-5a0b-b2e0-129d0b40b6f7"
   strings:
      $s1 = "screen.exe" fullword wide
      $s2 = "PlatformInvokeUSER32" fullword ascii
      $s3 = "GetDesktopImageF" fullword ascii
      $s4 = "PlatformInvokeGDI32" fullword ascii
      $s5 = "GetDesktopImage" fullword ascii
      $s6 = "Too many arguments, going to store in current dir" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 60KB and all of them )
}