deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: hancitor
Repository: Yara-Rules/rules
Detects: Memory string yara for Hancitor
Author: J from THL <j@techhelplist.com>

Pattern signatures:
$a = "GUID="	ascii
                $b = "&BUILD="	ascii
                $c = "&INFO="	ascii
                $d = "&IP="	ascii
                $e = "&TYPE=" 	ascii
                $f = "php|http"	ascii
		$g = "GUID=%I64u&BUILD=%s&INFO=%s&IP=%s&TYPE=1&WIN=%d.%d" ascii fullword

Detection condition:
5 of ($a,$b,$c,$d,$e,$f) or $g

Full rule:
rule hancitor {
	meta:
		description = "Memory string yara for Hancitor"
		author = "J from THL <j@techhelplist.com>"
		reference1 = "https://researchcenter.paloaltonetworks.com/2018/02/threat-brief-hancitor-actors/"
		reference2 = "https://www.virustotal.com/#/file/43e17f30b78c085e9bda8cadf5063cd5cec9edaa7441594ba1fe51391cc1c486/"
		reference3 = "https://www.virustotal.com/#/file/d135f03b9fdc709651ac9d0264e155c5580b072577a8ff24c90183b126b5e12a/"
		date = "2018-09-18"
		maltype1 = "Botnet"
		filetype = "memory"

	strings:
		$a = "GUID="	ascii
                $b = "&BUILD="	ascii
                $c = "&INFO="	ascii
                $d = "&IP="	ascii
                $e = "&TYPE=" 	ascii
                $f = "php|http"	ascii
		$g = "GUID=%I64u&BUILD=%s&INFO=%s&IP=%s&TYPE=1&WIN=%d.%d" ascii fullword


	condition:
		5 of ($a,$b,$c,$d,$e,$f) or $g

}
YARA Detection Rule: apt_backspace
Repository: Yara-Rules/rules
Detects: Detects APT backspace
Author: Bit Byte Bitten

Pattern signatures:
$s1 = "!! Use Splice Socket !!"
        $s2 = "User-Agent: SJZJ (compatible; MSIE 6.0; Win32)"
        $s3 = "g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d"

Detection condition:
uint16(0) == 0x5a4d and all of them

Full rule:
rule apt_backspace
{

    meta:
        description = "Detects APT backspace"
        author = "Bit Byte Bitten"
        date = "2015-05-14"
        hash = "6cbfeb7526de65eb2e3c848acac05da1e885636d17c1c45c62ad37e44cd84f99"
        
    strings:
        $s1 = "!! Use Splice Socket !!"
        $s2 = "User-Agent: SJZJ (compatible; MSIE 6.0; Win32)"
        $s3 = "g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d"

    condition:
        uint16(0) == 0x5a4d and all of them
}
YARA Detection Rule: wineggdrop
Repository: Yara-Rules/rules
Detects: Rules for TCP Portscanner VX.X by WinEggDrop
Malware family: Hackingtool/Portscanner
Author: Christian Rebischke (@sh1bumi)

Pattern signatures:
$a = { 54 43 50 20 50 6f 72 74 20 53 63 61 6e 6e 65 72 
               20 56 3? 2e 3? 20 42 79 20 57 69 6e 45 67 67 44 
               72 6f 70 0a } 
        $b = "Result.txt"
        $c = "Usage:   %s TCP/SYN StartIP [EndIP] Ports [Threads] [/T(N)] [/(H)Banner] [/Save]\n"

Detection condition:
//check for MZ Signature at offset 0
        uint16(0) == 0x5A4D

        and

        //check for wineggdrop specific strings
        $a and $b and $c

Full rule:
rule wineggdrop : portscanner toolkit
{
    meta:
        author = "Christian Rebischke (@sh1bumi)"
        date = "2015-09-05"
        description = "Rules for TCP Portscanner VX.X by WinEggDrop"
        in_the_wild = true
        family = "Hackingtool/Portscanner"

    strings:
        $a = { 54 43 50 20 50 6f 72 74 20 53 63 61 6e 6e 65 72 
               20 56 3? 2e 3? 20 42 79 20 57 69 6e 45 67 67 44 
               72 6f 70 0a } 
        $b = "Result.txt"
        $c = "Usage:   %s TCP/SYN StartIP [EndIP] Ports [Threads] [/T(N)] [/(H)Banner] [/Save]\n"

    condition:
        //check for MZ Signature at offset 0
        uint16(0) == 0x5A4D

        and

        //check for wineggdrop specific strings
        $a and $b and $c 
}
YARA Detection Rule: NetpassStrings
Repository: Yara-Rules/rules
Detects: Identifiers for netpass variant
Author: Katie Kleemola

Pattern signatures:
$exif1 = "Device Protect ApplicatioN" wide
                $exif2 = "beep.sys" wide //embedded exe name
                $exif3 = "BEEP Driver" wide //embedded exe description

                $string1 = "\x00NetPass Update\x00"
                $string2 = "\x00%s:DOWNLOAD\x00"
                $string3 = "\x00%s:UPDATE\x00"
                $string4 = "\x00%s:uNINSTALL\x00"

Detection condition:
all of ($exif*) or any of ($string*)

Full rule:
rule NetpassStrings : NetPass Variant {

        meta:
                description = "Identifiers for netpass variant"
                author = "Katie Kleemola"
                last_updated = "2014-05-29"

        strings:
                $exif1 = "Device Protect ApplicatioN" wide
                $exif2 = "beep.sys" wide //embedded exe name
                $exif3 = "BEEP Driver" wide //embedded exe description

                $string1 = "\x00NetPass Update\x00"
                $string2 = "\x00%s:DOWNLOAD\x00"
                $string3 = "\x00%s:UPDATE\x00"
                $string4 = "\x00%s:uNINSTALL\x00"

        condition:
                all of ($exif*) or any of ($string*)

}
YARA Detection Rule: NetPass
Repository: Yara-Rules/rules
Detects: netpass variant
Author: Katie Kleemola

Detection condition:
NetpassStrings

Full rule:
rule NetPass : Variant {
        meta:
                description = "netpass variant"
                author = "Katie Kleemola"
                last_updated = "2014-07-08"
        condition:
                NetpassStrings
}
YARA Detection Rule: NetTravStrings
Repository: Yara-Rules/rules
Detects: Identifiers for NetTraveler DLL
Author: Katie Kleemola

Pattern signatures:
//network strings
		$ = "?action=updated&hostid="
		$ = "travlerbackinfo"
		$ = "?action=getcmd&hostid="
		$ = "%s?action=gotcmd&hostid="
		$ = "%s?hostid=%s&hostname=%s&hostip=%s&filename=%s&filestart=%u&filetext="

		//debugging strings
		$ = "\x00Method1 Fail!!!!!\x00"
		$ = "\x00Method3 Fail!!!!!\x00"
		$ = "\x00method currect:\x00"
		$ = /\x00\x00[\w\-]+ is Running!\x00\x00/
		$ = "\x00OtherTwo\x00"

Detection condition:
any of them

Full rule:
rule NetTravStrings : NetTraveler Family {


	meta:
        	description = "Identifiers for NetTraveler DLL"
		author = "Katie Kleemola"
        	last_updated = "2014-05-20"

	strings:
		//network strings
		$ = "?action=updated&hostid="
		$ = "travlerbackinfo"
		$ = "?action=getcmd&hostid="
		$ = "%s?action=gotcmd&hostid="
		$ = "%s?hostid=%s&hostname=%s&hostip=%s&filename=%s&filestart=%u&filetext="

		//debugging strings
		$ = "\x00Method1 Fail!!!!!\x00"
		$ = "\x00Method3 Fail!!!!!\x00"
		$ = "\x00method currect:\x00"
		$ = /\x00\x00[\w\-]+ is Running!\x00\x00/
		$ = "\x00OtherTwo\x00"

	condition:
		any of them

}
YARA Detection Rule: NetTravExports
Repository: Yara-Rules/rules
Detects: Export names for dll component
Author: Katie Kleemola

Pattern signatures:
//dll component exports
		$ = "?InjectDll@@YAHPAUHWND__@@K@Z"
		$ = "?UnmapDll@@YAHXZ"
		$ = "?g_bSubclassed@@3HA"

Detection condition:
any of them

Full rule:
rule NetTravExports : NetTraveler Family {

	meta:
		description = "Export names for dll component"
		author = "Katie Kleemola"
		last_updated = "2014-05-20"
	
	strings:
		//dll component exports
		$ = "?InjectDll@@YAHPAUHWND__@@K@Z"
		$ = "?UnmapDll@@YAHXZ"
		$ = "?g_bSubclassed@@3HA"
		
	condition:
		any of them
}
YARA Detection Rule: NetTraveler
Repository: Yara-Rules/rules
Detects: Nettravelr
Author: Katie Kleemola

Detection condition:
NetTravExports or NetTravStrings or NetpassStrings

Full rule:
rule NetTraveler : Family {
	meta:
		description = "Nettravelr"
		author = "Katie Kleemola"
		last_updated = "2014-07-08"
	
	condition:
		NetTravExports or NetTravStrings or NetpassStrings

}
YARA Detection Rule: nkminer_monero
Repository: Yara-Rules/rules
Detects: Detects installer of Monero miner that points to a NK domain
Author: cdoman@alienvault.com
Reference: https://www.alienvault.com/blogs/labs-research/a-north-korean-monero-cryptocurrency-miner

Pattern signatures:
$a = "82e999fb-a6e0-4094-aa1f-1a306069d1a5" nocase wide ascii

 $b = "4JUdGzvrMFDWrUUwY3toJATSeNwjn54LkCnKBPRzDuhzi5vSepHfUckJNxRL2gjkNrSqtCoRUrEDAgRwsQvVCjZbRy5YeFCqgoUMnzumvS" nocase wide ascii

 $c = "barjuok.ryongnamsan.edu.kp" nocase wide ascii

 $d = "C:\\SoftwaresInstall\\soft" nocase wide ascii

 $e = "C:\\Windows\\Sys64\\intelservice.exe" nocase wide ascii

 $f = "C:\\Windows\\Sys64\\updater.exe" nocase wide ascii

 $g = "C:\\Users\\Jawhar\\documents\\" nocase wide ascii

Detection condition:
any of them

Full rule:
rule nkminer_monero {

 meta:

 description = "Detects installer of Monero miner that points to a NK domain"

 author = "cdoman@alienvault.com"
 
 reference = "https://www.alienvault.com/blogs/labs-research/a-north-korean-monero-cryptocurrency-miner"

 tlp = "white"

 license = "MIT License"

 strings:

 $a = "82e999fb-a6e0-4094-aa1f-1a306069d1a5" nocase wide ascii

 $b = "4JUdGzvrMFDWrUUwY3toJATSeNwjn54LkCnKBPRzDuhzi5vSepHfUckJNxRL2gjkNrSqtCoRUrEDAgRwsQvVCjZbRy5YeFCqgoUMnzumvS" nocase wide ascii

 $c = "barjuok.ryongnamsan.edu.kp" nocase wide ascii

 $d = "C:\\SoftwaresInstall\\soft" nocase wide ascii

 $e = "C:\\Windows\\Sys64\\intelservice.exe" nocase wide ascii

 $f = "C:\\Windows\\Sys64\\updater.exe" nocase wide ascii

 $g = "C:\\Users\\Jawhar\\documents\\" nocase wide ascii

 condition:

 any of them

}
YARA Detection Rule: sitrof_fortis_scar
Repository: Yara-Rules/rules
Author: J from THL <j@techhelplist.com>

Pattern signatures:
$a = "?get&version"
	$b = "?reg&ver="
	$c = "?get&exe"
	$d = "?get&download"
	$e = "?get&module"
	$f = "&ver="
	$g = "&comp="
	$h = "&addinfo="
	$i = "%s@%s; %s %s \"%s\" processor(s)"
	$j = "User-Agent: fortis"

Detection condition:
6 of them

Full rule:
rule sitrof_fortis_scar {

    meta:
        author = "J from THL <j@techhelplist.com>"
        date = "2018/23"
        reference1 = "https://www.virustotal.com/#/file/59ab6cb69712d82f3e13973ecc7e7d2060914cea6238d338203a69bac95fd96c/community"
	reference2 = "ETPRO rule 2806032, ETPRO TROJAN Win32.Scar.hhrw POST"
	version = 2
        maltype = "Stealer"
        filetype = "memory"

    strings:
	
	$a = "?get&version"
	$b = "?reg&ver="
	$c = "?get&exe"
	$d = "?get&download"
	$e = "?get&module"
	$f = "&ver="
	$g = "&comp="
	$h = "&addinfo="
	$i = "%s@%s; %s %s \"%s\" processor(s)"
	$j = "User-Agent: fortis"

    condition:
        6 of them
}
YARA Detection Rule: FlyingKitten
Repository: Yara-Rules/rules
Detects: Flying Kitten RAT
Author: CrowdStrike, Inc
Reference: http://blog.crowdstrike.com/cat-scratch-fever-crowdstrike-tracks-newly-reported-iranian-actor-flying-kitten

Pattern signatures:
$classpath = "Stealer.Properties.Resources.resources"
        $pdbstr = "\\Stealer\\obj\\x86\\Release\\Stealer.pdb"

Detection condition:
all of them and uint16(0) == 0x5A4D and uint32(uint32(0x3c)) == 0x4550 and uint16(uint32(0x3C) + 0x16) & 0x2000 == 0 and ((uint16(uint32(0x3c)+24) == 0x010b and uint32(uint32(0x3c)+232) > 0) or (uint16(uint32(0x3c)+24) == 0x020b and uint32(uint32(0x3c)+248) > 0))

Full rule:
rule FlyingKitten : rat
{
    meta:
        Author      = "CrowdStrike, Inc"
        Date        = "2014/05/13"
        Description = "Flying Kitten RAT"
        Reference   = "http://blog.crowdstrike.com/cat-scratch-fever-crowdstrike-tracks-newly-reported-iranian-actor-flying-kitten"

    strings:
        $classpath = "Stealer.Properties.Resources.resources"
        $pdbstr = "\\Stealer\\obj\\x86\\Release\\Stealer.pdb"

    condition:
        all of them and uint16(0) == 0x5A4D and uint32(uint32(0x3c)) == 0x4550 and uint16(uint32(0x3C) + 0x16) & 0x2000 == 0 and ((uint16(uint32(0x3c)+24) == 0x010b and uint32(uint32(0x3c)+232) > 0) or (uint16(uint32(0x3c)+24) == 0x020b and uint32(uint32(0x3c)+248) > 0)) 

}
YARA Detection Rule: CSIT_14003_03
Repository: Yara-Rules/rules
Detects: Flying Kitten Installer
Author: CrowdStrike, Inc
Reference: http://blog.crowdstrike.com/cat-scratch-fever-crowdstrike-tracks-newly-reported-iranian-actor-flying-kitten

Pattern signatures:
$exename = "IntelRapidStart.exe"
        $confname = "IntelRapidStart.exe.config"
        $cabhdr = { 4d 53 43 46 00 00 00 00 }

Detection condition:
all of them

Full rule:
rule CSIT_14003_03 : installer RAT
{ 
    meta:
        Author      = "CrowdStrike, Inc"
        Date        = "2014/05/13"
        Description = "Flying Kitten Installer"
        Reference   = "http://blog.crowdstrike.com/cat-scratch-fever-crowdstrike-tracks-newly-reported-iranian-actor-flying-kitten"

    strings:
        $exename = "IntelRapidStart.exe"
        $confname = "IntelRapidStart.exe.config"
        $cabhdr = { 4d 53 43 46 00 00 00 00 } 

    condition:
        all of them
}
YARA Detection Rule: MW_neuron2_loader_strings
Repository: Yara-Rules/rules
Detects: Rule for detection of Neuron2 based on strings within the loader
Malware family: Turla
Author: NCSC
Reference: https://www.ncsc.gov.uk/alerts/turla-group-malware

Pattern signatures:
$ = "dcom_api" ascii
        $ = "http://*:80/OWA/OAB/" ascii
        $ = "https://*:443/OWA/OAB/" ascii
        $ = "dcomnetsrv.cpp" wide
        $ = "dcomnet.dll" ascii
        $ = "D:\\Develop\\sps\\neuron2\\x64\\Release\\dcomnet.pdb" ascii

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and 2 of them

Full rule:
rule MW_neuron2_loader_strings : Turla APT loader
{
    meta:
        description = "Rule for detection of Neuron2 based on strings within the loader"
        author = "NCSC"
        family = "Turla"
        reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
        date = "2018-01-18"
        hash1 = "51616b207fde2ff1360a1364ff58270e0d46cf87a4c0c21b374a834dd9676927"
    strings:
        $ = "dcom_api" ascii
        $ = "http://*:80/OWA/OAB/" ascii
        $ = "https://*:443/OWA/OAB/" ascii
        $ = "dcomnetsrv.cpp" wide
        $ = "dcomnet.dll" ascii
        $ = "D:\\Develop\\sps\\neuron2\\x64\\Release\\dcomnet.pdb" ascii
    condition:
        (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and 2 of them
}
YARA Detection Rule: MW_neuron2_decryption_routine
Repository: Yara-Rules/rules
Detects: Rule for detection of Neuron2 based on the routine used to decrypt the payload
Malware family: Turla
Author: NCSC
Reference: https://www.ncsc.gov.uk/alerts/turla-group-malware

Pattern signatures:
$ = {81 FA FF 00 00 00 0F B6 C2 0F 46 C2 0F B6 0C 04 48 03 CF 0F B6 D1 8A 0C 14 8D 50 01 43 32 0C 13 41 88 0A 49 FF C2 49 83 E9 01}

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them

Full rule:
rule MW_neuron2_decryption_routine : Turla APT
{
    meta:
        description = "Rule for detection of Neuron2 based on the routine used to decrypt the payload"
        author = "NCSC"
        family = "Turla"
        reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
        date = "2018-01-18"
        hash1 = "51616b207fde2ff1360a1364ff58270e0d46cf87a4c0c21b374a834dd9676927"
    strings:
        $ = {81 FA FF 00 00 00 0F B6 C2 0F 46 C2 0F B6 0C 04 48 03 CF 0F B6 D1 8A 0C 14 8D 50 01 43 32 0C 13 41 88 0A 49 FF C2 49 83 E9 01}
    condition:
        (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
}
YARA Detection Rule: MW_neuron2_dotnet_strings
Repository: Yara-Rules/rules
Detects: Rule for detection of the .NET payload for Neuron2 based on strings used
Malware family: Turla
Author: NCSC
Reference: https://www.ncsc.gov.uk/alerts/turla-group-malware

Pattern signatures:
$dotnetMagic = "BSJB" ascii
        $s1 = "http://*:80/W3SVC/" wide
        $s2 = "https://*:443/W3SVC/" wide
        $s3 = "neuron2.exe" ascii
        $s4 = "D:\\Develop\\sps\\neuron2\\neuron2\\obj\\Release\\neuron2.pdb" ascii

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $dotnetMagic and 2 of ($s*)

Full rule:
rule MW_neuron2_dotnet_strings : Turla APT
{
    meta:
        description = "Rule for detection of the .NET payload for Neuron2 based on strings used"
        author = "NCSC"
        family = "Turla"
        reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
        date = "2018-01-18"
        hash1 = "83d8922e7a8212f1a2a9015973e668d7999b90e7000c31f57be83803747df015"
    strings:
        $dotnetMagic = "BSJB" ascii
        $s1 = "http://*:80/W3SVC/" wide
        $s2 = "https://*:443/W3SVC/" wide
        $s3 = "neuron2.exe" ascii
        $s4 = "D:\\Develop\\sps\\neuron2\\neuron2\\obj\\Release\\neuron2.pdb" ascii
    condition:
        (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $dotnetMagic and 2 of ($s*)
}
YARA Detection Rule: GoziRule
Repository: Yara-Rules/rules
Detects: Win32.Gozi
Author: CCN-CERT

Pattern signatures:
$ = {63 00 6F 00 6F 00 6B 00 69 00 65 00 73 00 2E 00 73 00 71 00 6C 00 69 00 74 00 65 00 2D 00 6A 00 6F 00 75 00 72 00 6E 00 61 00 6C 00 00 00 4F 50 45 52 41 2E 45 58 45 00}

Detection condition:
all of them

Full rule:
rule GoziRule : Gozi Family {
meta:
    description = "Win32.Gozi"
    author = "CCN-CERT"
    version = "1.0"
    ref = "https://www.ccn-cert.cni.es/informes/informes-ccn-cert-publicos.html"
strings:
    $ = {63 00 6F 00 6F 00 6B 00 69 00 65 00 73 00 2E 00 73 00 71 00 6C 00 69 00 74 00 65 00 2D 00 6A 00 6F 00 75 00 72 00 6E 00 61 00 6C 00 00 00 4F 50 45 52 41 2E 45 58 45 00}
condition:
    all of them
}
YARA Detection Rule: NaikonCode
Repository: Yara-Rules/rules
Detects: Naikon code features
Author: Seth Hardy

Pattern signatures:
// decryption
        $ = { 0F AF C1 C1 E0 1F } // imul eax, ecx; shl eah, 1fh
        $ = { 35 5A 01 00 00} // xor eax, 15ah
        $ = { 81 C2 7F 14 06 00 } // add edx, 6147fh

Detection condition:
all of them

Full rule:
rule NaikonCode : Naikon Family 
{
    meta:
        description = "Naikon code features"
        author = "Seth Hardy"
        last_modified = "2014-06-25"
    
    strings:
        // decryption
        $ = { 0F AF C1 C1 E0 1F } // imul eax, ecx; shl eah, 1fh
        $ = { 35 5A 01 00 00} // xor eax, 15ah
        $ = { 81 C2 7F 14 06 00 } // add edx, 6147fh
    
    condition:
        all of them
}
YARA Detection Rule: NaikonStrings
Repository: Yara-Rules/rules
Detects: Naikon Identifying Strings
Author: Seth Hardy

Pattern signatures:
$ = "NOKIAN95/WEB"
        $ = "/tag=info&id=15"
        $ = "skg(3)=&3.2d_u1"
        $ = "\\Temp\\iExplorer.exe"
        $ = "\\Temp\\\"TSG\""

Detection condition:
any of them

Full rule:
rule NaikonStrings : Naikon Family
{
    meta:
        description = "Naikon Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-06-25"
        
    strings:
        $ = "NOKIAN95/WEB"
        $ = "/tag=info&id=15"
        $ = "skg(3)=&3.2d_u1"
        $ = "\\Temp\\iExplorer.exe"
        $ = "\\Temp\\\"TSG\""
        
    condition:
       any of them
}
YARA Detection Rule: Naikon
Repository: Yara-Rules/rules
Detects: Naikon
Author: Seth Hardy

Detection condition:
NaikonCode or NaikonStrings

Full rule:
rule Naikon : Family
{
    meta:
        description = "Naikon"
        author = "Seth Hardy"
        last_modified = "2014-06-25"
        
    condition:
        NaikonCode or NaikonStrings
}
YARA Detection Rule: Backdoor_Naikon_APT_Sample1
Repository: Yara-Rules/rules
Detects: Detects backdoors related to the Naikon APT
Author: Florian Roth
Reference: https://goo.gl/7vHyvh

Pattern signatures:
$x0 = "GET http://%s:%d/aspxabcdef.asp?%s HTTP/1.1" fullword ascii
		$x1 = "POST http://%s:%d/aspxabcdefg.asp?%s HTTP/1.1" fullword ascii
		$x2 = "greensky27.vicp.net" fullword ascii
		$x3 = "\\tempvxd.vxd.dll" fullword wide
		$x4 = "otna.vicp.net" fullword ascii
		$x5 = "smithking19.gicp.net" fullword ascii
		
		$s1 = "User-Agent: webclient" fullword ascii
		$s2 = "\\User.ini" fullword ascii
		$s3 = "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/200" ascii
		$s4 = "\\UserProfile.dll" fullword wide
		$s5 = "Connection:Keep-Alive: %d" fullword ascii
		$s6 = "Referer: http://%s:%d/" fullword ascii
		$s7 = "%s %s %s %d %d %d " fullword ascii
		$s8 = "%s--%s" fullword wide
		$s9 = "Run File Success!" fullword wide
		$s10 = "DRIVE_REMOTE" fullword wide
		$s11 = "ProxyEnable" fullword wide
		$s12 = "\\cmd.exe" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and
		(
			1 of ($x*) or 7 of ($s*)
		)

Full rule:
rule Backdoor_Naikon_APT_Sample1 {
	meta:
		description = "Detects backdoors related to the Naikon APT"
		author = "Florian Roth"
		reference = "https://goo.gl/7vHyvh"
		date = "2015-05-14"
		hash = "d5716c80cba8554eb79eecfb4aa3d99faf0435a1833ec5ef51f528146c758eba"
		hash = "f5ab8e49c0778fa208baad660fe4fa40fc8a114f5f71614afbd6dcc09625cb96"
	strings:
		$x0 = "GET http://%s:%d/aspxabcdef.asp?%s HTTP/1.1" fullword ascii
		$x1 = "POST http://%s:%d/aspxabcdefg.asp?%s HTTP/1.1" fullword ascii
		$x2 = "greensky27.vicp.net" fullword ascii
		$x3 = "\\tempvxd.vxd.dll" fullword wide
		$x4 = "otna.vicp.net" fullword ascii
		$x5 = "smithking19.gicp.net" fullword ascii
		
		$s1 = "User-Agent: webclient" fullword ascii
		$s2 = "\\User.ini" fullword ascii
		$s3 = "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/200" ascii
		$s4 = "\\UserProfile.dll" fullword wide
		$s5 = "Connection:Keep-Alive: %d" fullword ascii
		$s6 = "Referer: http://%s:%d/" fullword ascii
		$s7 = "%s %s %s %d %d %d " fullword ascii
		$s8 = "%s--%s" fullword wide
		$s9 = "Run File Success!" fullword wide
		$s10 = "DRIVE_REMOTE" fullword wide
		$s11 = "ProxyEnable" fullword wide
		$s12 = "\\cmd.exe" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 1000KB and
		(
			1 of ($x*) or 7 of ($s*)
		)
}
YARA Detection Rule: apt_all_JavaScript_ScanboxFramework_obfuscated
Repository: Yara-Rules/rules

Pattern signatures:
$sa1 = /(var|new|return)\s[_\$]+\s?/

                  $sa2 = "function"

                  $sa3 = "toString"

                  $sa4 = "toUpperCase"

                  $sa5 = "arguments.length"

                  $sa6 = "return"

                  $sa7 = "while"

                  $sa8 = "unescape("

                  $sa9 = "365*10*24*60*60*1000"

                  $sa10 = ">> 2"

                  $sa11 = "& 3) << 4"

                  $sa12 = "& 15) << 2"

                  $sa13 = ">> 6) | 192"

                  $sa14 = "& 63) | 128"

                  $sa15 = ">> 12) | 224"

Detection condition:
all of them

Full rule:
rule apt_all_JavaScript_ScanboxFramework_obfuscated

{
              meta:
                    
                    ref = "https://www.fidelissecurity.com/TradeSecret"

                  strings:

              $sa1 = /(var|new|return)\s[_\$]+\s?/

                  $sa2 = "function"

                  $sa3 = "toString"

                  $sa4 = "toUpperCase"

                  $sa5 = "arguments.length"

                  $sa6 = "return"

                  $sa7 = "while"

                  $sa8 = "unescape("

                  $sa9 = "365*10*24*60*60*1000"

                  $sa10 = ">> 2"

                  $sa11 = "& 3) << 4"

                  $sa12 = "& 15) << 2"

                  $sa13 = ">> 6) | 192"

                  $sa14 = "& 63) | 128"

                  $sa15 = ">> 12) | 224"

                  condition:

                  all of them

}
YARA Detection Rule: TerminatorRat
Repository: Yara-Rules/rules
Detects: Terminator RAT
Author: Jean-Philippe Teissier / @Jipe_

Pattern signatures:
$a = "Accelorator"
		$b = "<html><title>12356</title><body>"

Detection condition:
all of them

Full rule:
rule TerminatorRat : RAT 
{
	meta:
		description = "Terminator RAT" 
		author = "Jean-Philippe Teissier / @Jipe_"
		date = "2013-10-24"
		filetype = "memory"
		version = "1.0" 
		ref1 = "http://www.fireeye.com/blog/technical/malware-research/2013/10/evasive-tactics-terminator-rat.html" 

	strings:
		$a = "Accelorator"
		$b = "<html><title>12356</title><body>"

	condition:
		all of them
}
YARA Detection Rule: TROJAN_Notepad_shell_crew
Repository: Yara-Rules/rules
Author: RSA_IR

Pattern signatures:
$s1 = "75BAA77C842BE168B0F66C42C7885997"
                $s2 = "B523F63566F407F3834BCC54AAA32524"

Detection condition:
$s1 or $s2

Full rule:
rule TROJAN_Notepad_shell_crew : Trojan {
        meta:
                author = "RSA_IR"
                Date     = "4Jun13"
                File     = "notepad.exe v 1.1"
                MD5      = "106E63DBDA3A76BEEB53A8BBD8F98927"
        strings:
                $s1 = "75BAA77C842BE168B0F66C42C7885997"
                $s2 = "B523F63566F407F3834BCC54AAA32524"
        condition:
                $s1 or $s2
}