deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: WEBSHELL_Cookie_Post_Obfuscation
Repository: Neo23x0/signature-base
Detects: Detects webshell using cookie POST
Author: Arnim Rupp (https://github.com/ruppde)
Reference: Internal Research

Pattern signatures:
$s1 = "]($_COOKIE, $_POST) as $"
        $s2 = "function"
        $s3 = "Array"

Detection condition:
( uint16(0) == 0x3f3c and filesize < 100KB and ( all of them ))

Full rule:
rule WEBSHELL_Cookie_Post_Obfuscation {
    meta:
        description = "Detects webshell using cookie POST"
        author = "Arnim Rupp (https://github.com/ruppde)"
        reference = "Internal Research"
        score = 75
        date = "2023-01-28"
        modified = "2023-04-05"
        license = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
        hash = "d08a00e56feb78b7f6599bad6b9b1d8626ce9a6ea1dfdc038358f4c74e6f65c9"
        hash = "2ce5c4d31682a5a59b665905a6f698c280451117e4aa3aee[PII_REDACTED]edb31"
        hash = "ff732d91a93dfd1612aed24bbb4d13edb0ab224d874f622943aaeeed4356c662"
        hash = "a3b64e9e065602d2863fcab641c75f5d8ec67c8632db0f78ca33ded0f4cea257"
        hash = "d41abce305b0dc9bd3a9feb0b6b35e8e39db9e75efb055d0b1205a9f0c89128e"
        hash = "333560bdc876fb0186fae97a58c27dd68123be875d510f46098fc5a61615f124"
        hash = "2efdb79cdde9396ff3dd567db[PII_REDACTED]718db692adf641f595626ef64d3a4"
        hash = "e1bd3be0cf525a0d61bf8c18e3ffaf3330c1c27c861aede486fd0f1b6930f69a"
        hash = "f8cdedd21b2cc29497896ec5b6e5863cd67cc1a798d929fd32cdbb654a69168a"

        id = "cc5ded80-5e58-5b25-86d1-1c492042c740"
    strings:
        $s1 = "]($_COOKIE, $_POST) as $"
        $s2 = "function"
        $s3 = "Array"
    condition:
    ( uint16(0) == 0x3f3c and filesize < 100KB and ( all of them ))
}
YARA Detection Rule: SUSP_CMD_Var_Expansion
Repository: Neo23x0/signature-base
Detects: Detects Office droppers that include a variable expansion string
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/asfakian/status/[PII_REDACTED]75843585

Pattern signatures:
$a1 = " /V:ON" ascii wide fullword

Detection condition:
uint16(0) == 0xcfd0 and filesize < 500KB and $a1

Full rule:
rule SUSP_CMD_Var_Expansion {
   meta:
      description = "Detects Office droppers that include a variable expansion string"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/asfakian/status/[PII_REDACTED]75843585"
      date = "2018-09-26"
      score = 60
      id = "3f3ebea0-1d33-513d-b32b-9d87607525e8"
   strings:
      $a1 = " /V:ON" ascii wide fullword
   condition:
      uint16(0) == 0xcfd0 and filesize < 500KB and $a1
}
YARA Detection Rule: HKTL_Khepri_Beacon_Sep21_1
Repository: Neo23x0/signature-base
Detects: Detects Khepri C2 framework beacons
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/geemion/Khepri/

Pattern signatures:
$x1 = "NT %d.%d Build %d  ProductType:%s" ascii fullword

      /* c2.CMDPARAM.cmd */
      $xe1 = "YzIuQ01EUEFSQU0uY21k" ascii
      $xe2 = "MyLkNNRFBBUkFNLmNtZ" ascii
      $xe3 = "jMi5DTURQQVJBTS5jbW" ascii
      
      $sx1 = "c2.ProcessItem.user" ascii fullword
      $sx2 = "c2.CMDPARAM.cmd" ascii fullword
      $sx3 = "c2.DownLoadFile.file_path" ascii fullword

      $sa1 = "file size zero"
      $sa2 = "cmd.exe /c "
      $sa3 = "error parse param"
      $sa4 = "innet_ip"

      $op1 = { c3 b9 b4 98 49 00 87 01 5d c3 b8 b8 98 49 00 c3 8b ff }
      $op2 = { 8b f1 80 3d 58 97 49 00 00 0f 85 96 00 00 00 33 c0 40 b9 50 97 49 00 87 01 33 db }
      $op3 = { 90 d5 0c 43 00 34 0d 43 00 ea 0c 43 00 7e 0d 43 00 b6 0d 43 00 cc }
      $op4 = { 69 c0 ff 00 00 00 8b 4d c0 23 88 40 7c 49 00 89 4d c0 8b 45 cc 0b 45 c0 89 45 cc 8b 45 d0 }

Detection condition:
( uint16(0) == 0x5a4d or uint32be(0) == 0x7f454c46 ) and
      filesize < 2000KB and (
         1 of ($x*) or
         2 of ($sx*) or
         all of ($sa*) or 
         3 of ($op*)
      ) or (
         filesize < 10MB 
         and 1 of ($xe*)
      ) 
      or 5 of them

Full rule:
rule HKTL_Khepri_Beacon_Sep21_1 {
   meta:
      description = "Detects Khepri C2 framework beacons"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/geemion/Khepri/"
      date = "2021-09-08"
      score = 90
      hash1 = "86c48679db5f4c085fd741ebec5235bc6cf0cdf8ef2d98fd8a689ceb5088f431"
      id = "b2c8aaf7-7953-55a3-8499-565800fa01f1"
   strings:
      $x1 = "NT %d.%d Build %d  ProductType:%s" ascii fullword

      /* c2.CMDPARAM.cmd */
      $xe1 = "YzIuQ01EUEFSQU0uY21k" ascii
      $xe2 = "MyLkNNRFBBUkFNLmNtZ" ascii
      $xe3 = "jMi5DTURQQVJBTS5jbW" ascii
      
      $sx1 = "c2.ProcessItem.user" ascii fullword
      $sx2 = "c2.CMDPARAM.cmd" ascii fullword
      $sx3 = "c2.DownLoadFile.file_path" ascii fullword

      $sa1 = "file size zero"
      $sa2 = "cmd.exe /c "
      $sa3 = "error parse param"
      $sa4 = "innet_ip"

      $op1 = { c3 b9 b4 98 49 00 87 01 5d c3 b8 b8 98 49 00 c3 8b ff }
      $op2 = { 8b f1 80 3d 58 97 49 00 00 0f 85 96 00 00 00 33 c0 40 b9 50 97 49 00 87 01 33 db }
      $op3 = { 90 d5 0c 43 00 34 0d 43 00 ea 0c 43 00 7e 0d 43 00 b6 0d 43 00 cc }
      $op4 = { 69 c0 ff 00 00 00 8b 4d c0 23 88 40 7c 49 00 89 4d c0 8b 45 cc 0b 45 c0 89 45 cc 8b 45 d0 }
   condition:
      ( uint16(0) == 0x5a4d or uint32be(0) == 0x7f454c46 ) and
      filesize < 2000KB and (
         1 of ($x*) or
         2 of ($sx*) or
         all of ($sa*) or 
         3 of ($op*)
      ) or (
         filesize < 10MB 
         and 1 of ($xe*)
      ) 
      or 5 of them
}
YARA Detection Rule: Servantshell
Repository: Neo23x0/signature-base
Detects: Detects Servantshell malware
Author: Arbor Networks ASERT Nov 2015
Reference: https://tinyurl.com/jmp7nrs

Pattern signatures:
$string1 = "SelfDestruction.cpp"
      $string2 = "SvtShell.cpp"
      $string3 = "InitServant"
      $string4 = "DeinitServant"
      $string5 = "CheckDT"

Detection condition:
uint16(0) == 0x5a4d and all of them

Full rule:
rule Servantshell {
   meta:
      author = "Arbor Networks ASERT Nov 2015"
      description = "Detects Servantshell malware"
      date = "2017-02-02"
      reference = "https://tinyurl.com/jmp7nrs"
      score = 70
      id = "f41e9191-0be1-59f7-9be4-e39c8a37b2c5"
   strings:
      $string1 = "SelfDestruction.cpp"
      $string2 = "SvtShell.cpp"
      $string3 = "InitServant"
      $string4 = "DeinitServant"
      $string5 = "CheckDT"
   condition:
      uint16(0) == 0x5a4d and all of them
}
YARA Detection Rule: StuxNet_Malware_1
Repository: Neo23x0/signature-base
Detects: Stuxnet Sample - file malware.exe
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
// 0x10001778 8b 45 08  mov     eax, dword ptr [ebp + 8]
		 // 0x1000177b 35 dd 79 19 ae    xor     eax, 0xae1979dd
		 // 0x10001780 33 c9     xor     ecx, ecx
		 // 0x10001782 8b 55 08  mov     edx, dword ptr [ebp + 8]
		 // 0x10001785 89 02     mov     dword ptr [edx], eax
		 // 0x10001787 89 ?? ??  mov     dword ptr [edx + 4], ecx
		 $op1 = { 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 }
		 // 0x10002045 74 36     je      0x1000207d
		 // 0x10002047 8b 7f 08  mov     edi, dword ptr [edi + 8]
		 // 0x1000204a 83 ff 00  cmp     edi, 0
		 // 0x1000204d 74 2e     je      0x1000207d
		 // 0x1000204f 0f b7 1f  movzx   ebx, word ptr [edi]
		 // 0x10002052 8b 7f 04  mov     edi, dword ptr [edi + 4]
		 $op2 = { 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 }
		 // 0x100020cf 74 70     je      0x10002141
		 // 0x100020d1 81 78 05 8d 54 24 04      cmp     dword ptr [eax + 5], 0x424548d
		 // 0x100020d8 75 1b     jne     0x100020f5
		 // 0x100020da 81 78 08 04 cd ?? ??      cmp     dword 

Detection condition:
all of them

Full rule:
rule StuxNet_Malware_1 {
	meta:
		description = "Stuxnet Sample - file malware.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-07-09"
		hash1 = "9c891edb5da763398969b6aaa86a5d46971bd28a455b20c2067cb512c9f9a0f8"
		id = "1f475dc3-ebb3-508f-b696-3d9ea270b13d"
	strings:
		 // 0x10001778 8b 45 08  mov     eax, dword ptr [ebp + 8]
		 // 0x1000177b 35 dd 79 19 ae    xor     eax, 0xae1979dd
		 // 0x10001780 33 c9     xor     ecx, ecx
		 // 0x10001782 8b 55 08  mov     edx, dword ptr [ebp + 8]
		 // 0x10001785 89 02     mov     dword ptr [edx], eax
		 // 0x10001787 89 ?? ??  mov     dword ptr [edx + 4], ecx
		 $op1 = { 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 }
		 // 0x10002045 74 36     je      0x1000207d
		 // 0x10002047 8b 7f 08  mov     edi, dword ptr [edi + 8]
		 // 0x1000204a 83 ff 00  cmp     edi, 0
		 // 0x1000204d 74 2e     je      0x1000207d
		 // 0x1000204f 0f b7 1f  movzx   ebx, word ptr [edi]
		 // 0x10002052 8b 7f 04  mov     edi, dword ptr [edi + 4]
		 $op2 = { 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 }
		 // 0x100020cf 74 70     je      0x10002141
		 // 0x100020d1 81 78 05 8d 54 24 04      cmp     dword ptr [eax + 5], 0x424548d
		 // 0x100020d8 75 1b     jne     0x100020f5
		 // 0x100020da 81 78 08 04 cd ?? ??      cmp     dword ptr [eax + 8], 0xc22ecd04
		 $op3 = { 74 70 81 78 05 8d 54 24 04 75 1b 81 78 08 04 cd }
	condition:
		all of them
}
YARA Detection Rule: Stuxnet_Malware_2
Repository: Neo23x0/signature-base
Detects: Stuxnet Sample
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "\\SystemRoot\\System32\\hal.dll" wide
		$s2 = "http://www.jmicron.co.tw0" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 70KB and all of them

Full rule:
rule Stuxnet_Malware_2 {
	meta:
		description = "Stuxnet Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-07-09"
		hash1 = "63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802"
		id = "2865353c-44c5-5280-878b-daadcef017b8"
	strings:
		$s1 = "\\SystemRoot\\System32\\hal.dll" wide
		$s2 = "http://www.jmicron.co.tw0" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 70KB and all of them
}
YARA Detection Rule: StuxNet_dll
Repository: Neo23x0/signature-base
Detects: Stuxnet Sample - file dll.dll
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "SUCKM3 FROM EXPLORER.EXE MOTH4FUCKA #@!" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and $s1

Full rule:
rule StuxNet_dll {
	meta:
		description = "Stuxnet Sample - file dll.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-07-09"
		hash1 = "9e392277f62206098cf794ddebafd2817483cfd57ec03c2e05e7c3c81e72f562"
		id = "92d812a6-2622-56e4-96c5-eb65ab7055b9"
	strings:
		$s1 = "SUCKM3 FROM EXPLORER.EXE MOTH4FUCKA #@!" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and $s1
}
YARA Detection Rule: Stuxnet_Shortcut_to
Repository: Neo23x0/signature-base
Detects: Stuxnet Sample - file Copy of Shortcut to.lnk
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "\\\\.\\STORAGE#Volume#_??_USBSTOR#Disk&Ven_Kingston&Prod_DataTraveler_2.0&Rev_PMAP#5B6B098B97BE&0#{53f56307-b6bf-11d0-94f2-00a0c" wide

Detection condition:
uint16(0) == 0x004c and filesize < 10KB and $x1

Full rule:
rule Stuxnet_Shortcut_to {
	meta:
		description = "Stuxnet Sample - file Copy of Shortcut to.lnk"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-07-09"
		hash1 = "801e3b6d84862163a735502f93b9663be53ccbdd7f12b0707336fecba3a829a2"
		id = "582ab12b-808e-5d5c-ba36-3bb987c4c552"
	strings:
		$x1 = "\\\\.\\STORAGE#Volume#_??_USBSTOR#Disk&Ven_Kingston&Prod_DataTraveler_2.0&Rev_PMAP#5B6B098B97BE&0#{53f56307-b6bf-11d0-94f2-00a0c" wide
	condition:
		uint16(0) == 0x004c and filesize < 10KB and $x1
}
YARA Detection Rule: Stuxnet_Malware_3
Repository: Neo23x0/signature-base
Detects: Stuxnet Sample - file ~WTR4141.tmp
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "SHELL32.DLL.ASLR." fullword wide

		$s1 = "~WTR4141.tmp" fullword wide
		$s2 = "~WTR4132.tmp" fullword wide
		$s3 = "totalcmd.exe" fullword wide
		$s4 = "wincmd.exe" fullword wide
		$s5 = "http://www.realtek.com0" fullword ascii
		$s6 = "{%08x-%08x-%08x-%08x}" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 150KB and ( $x1 or 3 of ($s*) ) ) or ( 5 of them )

Full rule:
rule Stuxnet_Malware_3 {
	meta:
		description = "Stuxnet Sample - file ~WTR4141.tmp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-07-09"
		hash1 = "6bcf88251c876ef00b2f32cf97456a3e306c2a263d487b0a50216c6e3cc07c6a"
		hash2 = "70f8789b03e38d07584f57581363afa848dd5c3a197f2483c6dfa4f3e7f78b9b"
		id = "1b0b301a-bf29-5080-a7d6-4d5f389bdf50"
	strings:
		$x1 = "SHELL32.DLL.ASLR." fullword wide

		$s1 = "~WTR4141.tmp" fullword wide
		$s2 = "~WTR4132.tmp" fullword wide
		$s3 = "totalcmd.exe" fullword wide
		$s4 = "wincmd.exe" fullword wide
		$s5 = "http://www.realtek.com0" fullword ascii
		$s6 = "{%08x-%08x-%08x-%08x}" fullword wide
	condition:
		( uint16(0) == 0x5a4d and filesize < 150KB and ( $x1 or 3 of ($s*) ) ) or ( 5 of them )
}
YARA Detection Rule: Stuxnet_Malware_4
Repository: Neo23x0/signature-base
Detects: Stuxnet Sample
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "\\objfre_w2k_x86\\i386\\guava.pdb" ascii
		$x2 = "MRxCls.sys" fullword wide
		$x3 = "MRXNET.Sys" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 80KB and 1 of them ) or ( all of them )

Full rule:
rule Stuxnet_Malware_4 {
	meta:
		description = "Stuxnet Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-07-09"
		hash1 = "0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198"
		hash2 = "1635ec04f069ccc8331d01fdf31132a4bc8f6fd3830ac94739df95ee093c555c"
		id = "fd3fa395-15f1-5a11-9740-03b897e4620b"
	strings:
		$x1 = "\\objfre_w2k_x86\\i386\\guava.pdb" ascii
		$x2 = "MRxCls.sys" fullword wide
		$x3 = "MRXNET.Sys" fullword wide
	condition:
		( uint16(0) == 0x5a4d and filesize < 80KB and 1 of them ) or ( all of them )
}
YARA Detection Rule: Stuxnet_maindll_decrypted_unpacked
Repository: Neo23x0/signature-base
Detects: Stuxnet Sample - file maindll.decrypted.unpacked.dll_
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "%SystemRoot%\\system32\\Drivers\\mrxsmb.sys;%SystemRoot%\\system32\\Drivers\\*.sys" fullword wide
		$s2 = "<Actions Context=\"%s\"><Exec><Command>%s</Command><Arguments>%s,#%u</Arguments></Exec></Actions>" fullword wide
		$s3 = "%SystemRoot%\\inf\\oem7A.PNF" fullword wide
		$s4 = "%SystemRoot%\\inf\\mdmcpq3.PNF" fullword wide
		$s5 = "%SystemRoot%\\inf\\oem6C.PNF" fullword wide
		$s6 = "@abf varbinary(4096) EXEC @hr = sp_OACreate 'ADODB.Stream', @aods OUT IF @hr <> 0 GOTO endq EXEC @hr = sp_OASetProperty @" wide
		$s7 = "STORAGE#Volume#1&19f7e59c&0&" fullword wide
		$s8 = "view MCPVREADVARPERCON as select VARIABLEID,VARIABLETYPEID,FORMATFITTING,SCALEID,VARIABLENAME,ADDRESSPARAMETER,PROTOKOLL,MAXLIMI" ascii

Detection condition:
6 of them

Full rule:
rule Stuxnet_maindll_decrypted_unpacked {
	meta:
		description = "Stuxnet Sample - file maindll.decrypted.unpacked.dll_"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-07-09"
		hash1 = "4c3d7b38339d7b8adf73eaf85f0eb9fab4420585c6ab6950ebd360428af11712"
		id = "7009a41c-0588-5392-ae1c-045e0a5ee56b"
	strings:
		$s1 = "%SystemRoot%\\system32\\Drivers\\mrxsmb.sys;%SystemRoot%\\system32\\Drivers\\*.sys" fullword wide
		$s2 = "<Actions Context=\"%s\"><Exec><Command>%s</Command><Arguments>%s,#%u</Arguments></Exec></Actions>" fullword wide
		$s3 = "%SystemRoot%\\inf\\oem7A.PNF" fullword wide
		$s4 = "%SystemRoot%\\inf\\mdmcpq3.PNF" fullword wide
		$s5 = "%SystemRoot%\\inf\\oem6C.PNF" fullword wide
		$s6 = "@abf varbinary(4096) EXEC @hr = sp_OACreate 'ADODB.Stream', @aods OUT IF @hr <> 0 GOTO endq EXEC @hr = sp_OASetProperty @" wide
		$s7 = "STORAGE#Volume#1&19f7e59c&0&" fullword wide
		$s8 = "view MCPVREADVARPERCON as select VARIABLEID,VARIABLETYPEID,FORMATFITTING,SCALEID,VARIABLENAME,ADDRESSPARAMETER,PROTOKOLL,MAXLIMI" ascii
	condition:
		 6 of them
}
YARA Detection Rule: Stuxnet_s7hkimdb
Repository: Neo23x0/signature-base
Detects: Stuxnet Sample - file s7hkimdb.dll
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "S7HKIMDX.DLL" fullword wide

		/* Opcodes by Binar.ly */

		// 0x10001778 8b 45 08  mov     eax, dword ptr [ebp + 8]
		// 0x1000177b 35 dd 79 19 ae    xor     eax, 0xae1979dd
		// 0x10001780 33 c9     xor     ecx, ecx
		// 0x10001782 8b 55 08  mov     edx, dword ptr [ebp + 8]
		// 0x10001785 89 02     mov     dword ptr [edx], eax
		// 0x10001787 89 ?? ??  mov     dword ptr [edx + 4], ecx
		$op1 = { 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 }
		// 0x10002045 74 36     je      0x1000207d
		// 0x10002047 8b 7f 08  mov     edi, dword ptr [edi + 8]
		// 0x1000204a 83 ff 00  cmp     edi, 0
		// 0x1000204d 74 2e     je      0x1000207d
		// 0x1000204f 0f b7 1f  movzx   ebx, word ptr [edi]
		// 0x10002052 8b 7f 04  mov     edi, dword ptr [edi + 4]
		$op2 = { 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 }
		// 0x100020cf 74 70     je      0x10002141
		// 0x100020d1 81 78 05 8d 54 24 04      cmp     dword ptr [eax + 5], 0x424548d
		// 0x100020d8 75 1b     jne     0x100020f5
		// 0

Detection condition:
( uint16(0) == 0x5a4d and filesize < 40KB and $x1 and all of ($op*) )

Full rule:
rule Stuxnet_s7hkimdb {
	meta:
		description = "Stuxnet Sample - file s7hkimdb.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-07-09"
		hash1 = "4071ec265a44d1f0d42ff92b2fa0b30aafa7f6bb2160ed1d0d5372d70ac654bd"
		id = "e4cb277f-5eee-5405-9d48-d[PII_REDACTED]3"
	strings:
		$x1 = "S7HKIMDX.DLL" fullword wide

		/* Opcodes by Binar.ly */

		// 0x10001778 8b 45 08  mov     eax, dword ptr [ebp + 8]
		// 0x1000177b 35 dd 79 19 ae    xor     eax, 0xae1979dd
		// 0x10001780 33 c9     xor     ecx, ecx
		// 0x10001782 8b 55 08  mov     edx, dword ptr [ebp + 8]
		// 0x10001785 89 02     mov     dword ptr [edx], eax
		// 0x10001787 89 ?? ??  mov     dword ptr [edx + 4], ecx
		$op1 = { 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 }
		// 0x10002045 74 36     je      0x1000207d
		// 0x10002047 8b 7f 08  mov     edi, dword ptr [edi + 8]
		// 0x1000204a 83 ff 00  cmp     edi, 0
		// 0x1000204d 74 2e     je      0x1000207d
		// 0x1000204f 0f b7 1f  movzx   ebx, word ptr [edi]
		// 0x10002052 8b 7f 04  mov     edi, dword ptr [edi + 4]
		$op2 = { 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 }
		// 0x100020cf 74 70     je      0x10002141
		// 0x100020d1 81 78 05 8d 54 24 04      cmp     dword ptr [eax + 5], 0x424548d
		// 0x100020d8 75 1b     jne     0x100020f5
		// 0x100020da 81 78 08 04 cd ?? ??      cmp     dword ptr [eax + 8], 0xc22ecd04
		$op3 = { 74 70 81 78 05 8d 54 24 04 75 1b 81 78 08 04 cd }

	condition:
		( uint16(0) == 0x5a4d and filesize < 40KB and $x1 and all of ($op*) )
}
YARA Detection Rule: HKTL_SentinelOne_RemotePotato0_PrivEsc
Repository: Neo23x0/signature-base
Detects: Detects RemotePotato0 binary
Author: SentinelOne
Reference: https://labs.sentinelone.com/relaying-potatoes-dce-rpc-ntlm-relay-eop

Pattern signatures:
$import1 = "CoGetInstanceFromIStorage"
      $istorage_clsid = "{[PII_REDACTED]-c[PII_REDACTED]00046}" nocase wide ascii    
      $meow_header = { 4d 45 4f 57 }
      $clsid1 = "{[PII_REDACTED]-[PII_REDACTED]}" wide ascii
      $clsid2 = "{5167B42F-C111-47A1-ACC4-8EABE61B0B54}" nocase wide ascii

Detection condition:
(uint16(0) == 0x5A4D) and $import1 and $istorage_clsid and $meow_header and 1 of ($clsid*)

Full rule:
rule HKTL_SentinelOne_RemotePotato0_PrivEsc {
   meta:
      author = "SentinelOne"    
      description = "Detects RemotePotato0 binary"
      reference = "https://labs.sentinelone.com/relaying-potatoes-dce-rpc-ntlm-relay-eop"
      date = "2021-04-26"
      id = "f6dffd6b-e794-5c4a-9700-5c2022168f44"
   strings:    
      $import1 = "CoGetInstanceFromIStorage"
      $istorage_clsid = "{[PII_REDACTED]-c[PII_REDACTED]00046}" nocase wide ascii    
      $meow_header = { 4d 45 4f 57 }
      $clsid1 = "{[PII_REDACTED]-[PII_REDACTED]}" wide ascii
      $clsid2 = "{5167B42F-C111-47A1-ACC4-8EABE61B0B54}" nocase wide ascii
   condition:       
      (uint16(0) == 0x5A4D) and $import1 and $istorage_clsid and $meow_header and 1 of ($clsid*)
}
YARA Detection Rule: SnakeTurla_Malware_May17_1
Repository: Neo23x0/signature-base
Detects: Detects Snake / Turla Sample
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/QaOh4V

Pattern signatures:
$s1 = "/Users/vlad/Desktop/install/install/" ascii

Detection condition:
( uint16(0) == 0xfacf and filesize < 200KB and all of them )

Full rule:
rule SnakeTurla_Malware_May17_1 {
   meta:
      description = "Detects Snake / Turla Sample"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/QaOh4V"
      date = "2017-05-04"
      modified = "2023-01-06"
      hash1 = "5b7792a16c6b7978fca389882c6aeeb2c792352076bf6a064e7b8b90eace8060"
      id = "ddbbd602-b7f0-5e14-be0f-0c84bb22ddeb"
   strings:
      $s1 = "/Users/vlad/Desktop/install/install/" ascii
   condition:
      ( uint16(0) == 0xfacf and filesize < 200KB and all of them )
}
YARA Detection Rule: SnakeTurla_Malware_May17_2
Repository: Neo23x0/signature-base
Detects: Detects Snake / Turla Sample
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/QaOh4V

Pattern signatures:
$s1 = "b_openssl: oops - number of mutexes is 0" fullword ascii
      $s2 = "networksetup -get%sproxy Ethernet" fullword ascii
      $s3 = "012A04DECBC441e49C527B2798F54CA7LOG_NAMED_PIPE_NAME" fullword ascii

Detection condition:
( uint16(0) == 0xfacf and filesize < 6000KB and all of them )

Full rule:
rule SnakeTurla_Malware_May17_2 {
   meta:
      description = "Detects Snake / Turla Sample"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/QaOh4V"
      date = "2017-05-04"
      hash1 = "b8ee4556dc09b28826359b98343a4e00680971a6f8c6602747bd5d723d26eaea"
      id = "b3e94016-591c-5e39-b5e7-328e0761e535"
   strings:
      $s1 = "b_openssl: oops - number of mutexes is 0" fullword ascii
      $s2 = "networksetup -get%sproxy Ethernet" fullword ascii
      $s3 = "012A04DECBC441e49C527B2798F54CA7LOG_NAMED_PIPE_NAME" fullword ascii
   condition:
      ( uint16(0) == 0xfacf and filesize < 6000KB and all of them )
}