deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EQGRP_teflondoor
Repository: Neo23x0/signature-base
Detects: Detects tool from EQGRP toolset - file teflondoor.exe
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$x1 = "%s: abort.  Code is %d.  Message is '%s'" fullword ascii
		$x2 = "%s: %li b (%li%%)" fullword ascii

		$s1 = "no winsock" fullword ascii
		$s2 = "%s: %s file '%s'" fullword ascii
		$s3 = "peer: connect" fullword ascii
		$s4 = "read: write" fullword ascii
		$s5 = "%s: done!" fullword ascii
		$s6 = "%s: %li b" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 30KB and 1 of ($x*) and 3 of them

Full rule:
rule EQGRP_teflondoor {
	meta:
		description = "Detects tool from EQGRP toolset - file teflondoor.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-15"
		score = 75
		id = "188f9ef1-5524-50be-ac62-91cb9726b155"
	strings:
		$x1 = "%s: abort.  Code is %d.  Message is '%s'" fullword ascii
		$x2 = "%s: %li b (%li%%)" fullword ascii

		$s1 = "no winsock" fullword ascii
		$s2 = "%s: %s file '%s'" fullword ascii
		$s3 = "peer: connect" fullword ascii
		$s4 = "read: write" fullword ascii
		$s5 = "%s: done!" fullword ascii
		$s6 = "%s: %li b" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 30KB and 1 of ($x*) and 3 of them
}
YARA Detection Rule: EQGRP_durablenapkin_solaris_2_0_1
Repository: Neo23x0/signature-base
Detects: Detects tool from EQGRP toolset - file durablenapkin.solaris.2.0.1.1
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "recv_ack: %s: Service not supplied by provider" fullword ascii
		$s2 = "send_request: putmsg \"%s\": %s" fullword ascii
		$s3 = "port undefined" fullword ascii
		$s4 = "recv_ack: %s getmsg: %s" fullword ascii
		$s5 = ">> %d -- %d" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 40KB and 2 of them )

Full rule:
rule EQGRP_durablenapkin_solaris_2_0_1 {
	meta:
		description = "Detects tool from EQGRP toolset - file durablenapkin.solaris.2.0.1.1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-15"
		score = 75
		id = "7b49a26d-9ee3-5aff-93fc-509239daef28"
	strings:
		$s1 = "recv_ack: %s: Service not supplied by provider" fullword ascii
		$s2 = "send_request: putmsg \"%s\": %s" fullword ascii
		$s3 = "port undefined" fullword ascii
		$s4 = "recv_ack: %s getmsg: %s" fullword ascii
		$s5 = ">> %d -- %d" fullword ascii
	condition:
		( uint16(0) == 0x457f and filesize < 40KB and 2 of them )
}
YARA Detection Rule: EQGRP_teflonhandle
Repository: Neo23x0/signature-base
Detects: Detects tool from EQGRP toolset - file teflonhandle.exe
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "%s [infile] [outfile] /k 0x[%i character hex key] </g>" fullword ascii
		$s2 = "File %s already exists.  Overwrite? (y/n) " fullword ascii
		$s3 = "Random Key : 0x" fullword ascii
		$s4 = "done (%i bytes written)." fullword ascii
		$s5 = "%s --> %s..." fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 20KB and 2 of them

Full rule:
rule EQGRP_teflonhandle {
	meta:
		description = "Detects tool from EQGRP toolset - file teflonhandle.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-15"
		score = 75
		id = "4d82cc41-3777-5f8c-9392-aca69e6ed781"
	strings:
		$s1 = "%s [infile] [outfile] /k 0x[%i character hex key] </g>" fullword ascii
		$s2 = "File %s already exists.  Overwrite? (y/n) " fullword ascii
		$s3 = "Random Key : 0x" fullword ascii
		$s4 = "done (%i bytes written)." fullword ascii
		$s5 = "%s --> %s..." fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 20KB and 2 of them
}
YARA Detection Rule: EQGRP_false
Repository: Neo23x0/signature-base
Detects: Detects tool from EQGRP toolset - file false.exe
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = { 00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
			00 25 6C 75 2E 25 6C 75 2E 25 6C 75 2E 25 6C 75
			00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
			00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
			00 25 32 2E 32 58 20 00 00 0A 00 00 00 25 64 20
			2D 20 25 64 20 25 64 0A 00 25 64 0A 00 25 64 2E
			0A 00 00 00 00 25 64 2E 0A 00 00 00 00 25 64 2E
			0A 00 00 00 00 25 64 20 2D 20 25 64 0A 00 00 00
			00 25 64 20 2D 20 25 64 }

Detection condition:
uint16(0) == 0x5a4d and filesize < 50KB and $s1

Full rule:
rule EQGRP_false {
	meta:
		description = "Detects tool from EQGRP toolset - file false.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-15"
		score = 75
		id = "3a68790b-38fc-570b-8b19-c5478cdd2842"
	strings:
		$s1 = { 00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
			00 25 6C 75 2E 25 6C 75 2E 25 6C 75 2E 25 6C 75
			00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
			00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
			00 25 32 2E 32 58 20 00 00 0A 00 00 00 25 64 20
			2D 20 25 64 20 25 64 0A 00 25 64 0A 00 25 64 2E
			0A 00 00 00 00 25 64 2E 0A 00 00 00 00 25 64 2E
			0A 00 00 00 00 25 64 20 2D 20 25 64 0A 00 00 00
			00 25 64 20 2D 20 25 64 }
	condition:
		uint16(0) == 0x5a4d and filesize < 50KB and $s1
}
YARA Detection Rule: EQGRP_dn_1_0_2_1
Repository: Neo23x0/signature-base
Detects: Detects tool from EQGRP toolset - file dn.1.0.2.1.linux
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "Valid commands are: SMAC, DMAC, INT, PACK, DONE, GO" fullword ascii
		$s2 = "invalid format suggest DMAC=00:00:00:00:00:00" fullword ascii
		$s3 = "SMAC=%02x:%02x:%02x:%02x:%02x:%02x" fullword ascii
		$s4 = "Not everything is set yet" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 30KB and 2 of them )

Full rule:
rule EQGRP_dn_1_0_2_1 {
	meta:
		description = "Detects tool from EQGRP toolset - file dn.1.0.2.1.linux"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-15"
		score = 75
		id = "24b5fb51-2463-56ef-818a-949b4b3bbf5b"
	strings:
		$s1 = "Valid commands are: SMAC, DMAC, INT, PACK, DONE, GO" fullword ascii
		$s2 = "invalid format suggest DMAC=00:00:00:00:00:00" fullword ascii
		$s3 = "SMAC=%02x:%02x:%02x:%02x:%02x:%02x" fullword ascii
		$s4 = "Not everything is set yet" fullword ascii
	condition:
		( uint16(0) == 0x457f and filesize < 30KB and 2 of them )
}
YARA Detection Rule: EQGRP_morel
Repository: Neo23x0/signature-base
Detects: Detects tool from EQGRP toolset - file morel.exe
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "%d - %d, %d" fullword ascii
		$s2 = "%d - %lu.%lu %d.%lu" fullword ascii
		$s3 = "%d - %d %d" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 60KB and all of them )

Full rule:
rule EQGRP_morel {
	meta:
		description = "Detects tool from EQGRP toolset - file morel.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-15"
		score = 75
		hash1 = "a9152e67f507c9a179bb8478b58e5c71c444a5a39ae3082e04820a0613cd6d9f"
		id = "e741b727-0e41-53d0-832c-df7f4ea7964a"
	strings:
		$s1 = "%d - %d, %d" fullword ascii
		$s2 = "%d - %lu.%lu %d.%lu" fullword ascii
		$s3 = "%d - %d %d" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 60KB and all of them )
}
YARA Detection Rule: EQGRP_bc_parser
Repository: Neo23x0/signature-base
Detects: Detects tool from EQGRP toolset - file bc-parser
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "*** Target may be susceptible to FALSEMOREL      ***" fullword ascii
		$s2 = "*** Target is susceptible to FALSEMOREL          ***" fullword ascii

Detection condition:
uint16(0) == 0x457f and 1 of them

Full rule:
rule EQGRP_bc_parser {
	meta:
		description = "Detects tool from EQGRP toolset - file bc-parser"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-15"
		score = 75
		hash1 = "879f2f1ae5d18a3a5310aeeafec[PII_REDACTED]9644e5ecb7d8a72f0877ac19cee"
		id = "ed4523de-b126-503a-83bd-aafd8533b0e5"
	strings:
		$s1 = "*** Target may be susceptible to FALSEMOREL      ***" fullword ascii
		$s2 = "*** Target is susceptible to FALSEMOREL          ***" fullword ascii
	condition:
		uint16(0) == 0x457f and 1 of them
}
YARA Detection Rule: EQGRP_1212
Repository: Neo23x0/signature-base
Detects: Detects tool from EQGRP toolset - file 1212.pl
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "if (!(($srcip,$dstip,$srcport,$dstport) = ($line=~/^([a-f0-9]{8})([a-f0-9]{8})([a-f0-9]{4})([a-f0-9]{4})$/)))" fullword ascii
		$s2 = "$ans=\"$srcip:$srcport -> $dstip:$dstport\";" fullword ascii
		$s3 = "return \"ERROR:$line is not a valid port\";" fullword ascii
		$s4 = "$dstport=hextoPort($dstport);" fullword ascii
		$s5 = "sub hextoPort" fullword ascii
		$s6 = "$byte_table{\"$chars[$sixteens]$chars[$ones]\"}=$i;" fullword ascii

Detection condition:
filesize < 6KB and 4 of them

Full rule:
rule EQGRP_1212 {
	meta:
		description = "Detects tool from EQGRP toolset - file 1212.pl"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-15"
		score = 75
		id = "428fed4f-df5c-5fc2-ac4b-4dea69ea4f2d"
	strings:
		$s1 = "if (!(($srcip,$dstip,$srcport,$dstport) = ($line=~/^([a-f0-9]{8})([a-f0-9]{8})([a-f0-9]{4})([a-f0-9]{4})$/)))" fullword ascii
		$s2 = "$ans=\"$srcip:$srcport -> $dstip:$dstport\";" fullword ascii
		$s3 = "return \"ERROR:$line is not a valid port\";" fullword ascii
		$s4 = "$dstport=hextoPort($dstport);" fullword ascii
		$s5 = "sub hextoPort" fullword ascii
		$s6 = "$byte_table{\"$chars[$sixteens]$chars[$ones]\"}=$i;" fullword ascii
	condition:
		filesize < 6KB and 4 of them
}
YARA Detection Rule: EQGRP_1212_dehex
Repository: Neo23x0/signature-base
Detects: Detects tool from EQGRP toolset - from files 1212.pl, dehex.pl
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "return \"ERROR:$line is not a valid address\";" fullword ascii
		$s2 = "print \"ERROR: the filename or hex representation needs to be one argument try using \\\"'s\\n\";" fullword ascii
		$s3 = "push(@octets,$byte_table{$tempi});" fullword ascii
		$s4 = "$byte_table{\"$chars[$sixteens]$chars[$ones]\"}=$i;" fullword ascii
		$s5 = "print hextoIP($ARGV[0]);" fullword ascii

Detection condition:
( uint16(0) == 0x2123 and filesize < 6KB and ( 5 of ($s*) ) ) or ( all of them )

Full rule:
rule EQGRP_1212_dehex {
	meta:
		description = "Detects tool from EQGRP toolset - from files 1212.pl, dehex.pl"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-15"
		score = 75
		id = "2cc375e6-2bff-5623-b86c-a6413f736c42"
	strings:
		$s1 = "return \"ERROR:$line is not a valid address\";" fullword ascii
		$s2 = "print \"ERROR: the filename or hex representation needs to be one argument try using \\\"'s\\n\";" fullword ascii
		$s3 = "push(@octets,$byte_table{$tempi});" fullword ascii
		$s4 = "$byte_table{\"$chars[$sixteens]$chars[$ones]\"}=$i;" fullword ascii
		$s5 = "print hextoIP($ARGV[0]);" fullword ascii
	condition:
		( uint16(0) == 0x2123 and filesize < 6KB and ( 5 of ($s*) ) ) or ( all of them )
}
YARA Detection Rule: install_get_persistent_filenames
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file install_get_persistent_filenames
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "Generates the persistence file name and prints it out." fullword ascii

Detection condition:
( uint16(0) == 0x457f and all of them )

Full rule:
rule install_get_persistent_filenames {
	meta:
		description = "EQGRP Toolset Firewall - file install_get_persistent_filenames"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "4a50ec4bf42087e932e9e67e0ea4c09e52a475d351981bb4c9851fda02b35291"
		id = "cf74b479-4b78-537a-878c-2f3ce004b775"
	strings:
		$s1 = "Generates the persistence file name and prints it out." fullword ascii
	condition:
		( uint16(0) == 0x457f and all of them )
}
YARA Detection Rule: EQGRP_create_dns_injection
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file create_dns_injection.py
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "Name:   A hostname: 'host.network.com', a decimal numeric offset within" fullword ascii
		$s2 = " www.badguy.net,CNAME,1800,host.badguy.net \\\\" ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_create_dns_injection {
	meta:
		description = "EQGRP Toolset Firewall - file create_dns_injection.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "488f3cc21db0688d09e13eb85a197a1d37902612c3e302132c84e07bc42b1c32"
		id = "ef358ca6-ebd8-5d08-944b-f1fcd112f1f3"
	strings:
		$s1 = "Name:   A hostname: 'host.network.com', a decimal numeric offset within" fullword ascii
		$s2 = " www.badguy.net,CNAME,1800,host.badguy.net \\\\" ascii
	condition:
		1 of them
}
YARA Detection Rule: EQGRP_screamingplow
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file screamingplow.sh
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "What is the name of your PBD:" fullword ascii
		$s2 = "You are now ready for a ScreamPlow" fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_screamingplow {
	meta:
		description = "EQGRP Toolset Firewall - file screamingplow.sh"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "c7f4104c4607a03a1d27c832e1ebfc6ab252a27a1709015b5f1617b534f0090a"
		id = "cb535ef0-e3ea-54cc-9082-3d63cc96d93a"
	strings:
		$s1 = "What is the name of your PBD:" fullword ascii
		$s2 = "You are now ready for a ScreamPlow" fullword ascii
	condition:
		1 of them
}
YARA Detection Rule: EQGRP_MixText
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file MixText.py
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "BinStore enabled implants." fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_MixText {
	meta:
		description = "EQGRP Toolset Firewall - file MixText.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "e4d24e30e6cc3a0aa0032dbbd2b68c60bac216bef524eaf56296430aa05b3795"
		id = "99b06100-8a05-5c22-8b7d-ed451d5f4e81"
	strings:
		$s1 = "BinStore enabled implants." fullword ascii
	condition:
		1 of them
}
YARA Detection Rule: EQGRP_tunnel_state_reader
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file tunnel_state_reader
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "Active connections will be maintained for this tunnel. Timeout:" fullword ascii
		$s5 = "%s: compatible with BLATSTING version 1.2" fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_tunnel_state_reader {
	meta:
		description = "EQGRP Toolset Firewall - file tunnel_state_reader"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "49d48ca1ec741f462fde80da68b64dfa[PII_REDACTED]520d29e345ef563113616c"
		id = "e48c9482-eae5-5c34-b7b2-502d0252f4a0"
	strings:
		$s1 = "Active connections will be maintained for this tunnel. Timeout:" fullword ascii
		$s5 = "%s: compatible with BLATSTING version 1.2" fullword ascii
	condition:
		1 of them
}
YARA Detection Rule: EQGRP_payload
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file payload.py
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "can't find target version module!" fullword ascii
		$s2 = "class Payload:" fullword ascii

Detection condition:
all of them

Full rule:
rule EQGRP_payload {
	meta:
		description = "EQGRP Toolset Firewall - file payload.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "21bed6d699b1fbde74cbcec93575c9694d5bea832cd191f59eb3e4140e5c5e07"
		id = "949cb68b-e384-578c-a906-a4d9234dc668"
	strings:
		$s1 = "can't find target version module!" fullword ascii
		$s2 = "class Payload:" fullword ascii
	condition:
		all of them
}
YARA Detection Rule: EQGRP_eligiblecandidate
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file eligiblecandidate.py
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$o1 = "Connection timed out. Only a problem if the callback was not received." fullword ascii
		$o2 = "Could not reliably detect cookie. Using 'session_id'..." fullword ascii

		$c1 = "def build_exploit_payload(self,cmd=\"/tmp/httpd\"):" fullword ascii
		$c2 = "self.build_exploit_payload(cmd)" fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_eligiblecandidate {
	meta:
		description = "EQGRP Toolset Firewall - file eligiblecandidate.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "c4567c00734dedf1c875ecbbd56c1561a1610bedb4621d9c8899acec57353d86"
		id = "e084b051-4aa1-54b2-9f56-69db386b46d6"
	strings:
		$o1 = "Connection timed out. Only a problem if the callback was not received." fullword ascii
		$o2 = "Could not reliably detect cookie. Using 'session_id'..." fullword ascii

		$c1 = "def build_exploit_payload(self,cmd=\"/tmp/httpd\"):" fullword ascii
		$c2 = "self.build_exploit_payload(cmd)" fullword ascii
	condition:
		1 of them
}
YARA Detection Rule: EQGRP_BUSURPER_2211_724
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file BUSURPER-2211-724.exe
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = ".got_loader" fullword ascii
		$s2 = "_start_text" ascii
		$s3 = "IMPLANT" fullword ascii
		$s4 = "KEEPGOING" fullword ascii
		$s5 = "upgrade_implant" fullword ascii

Detection condition:
all of them

Full rule:
rule EQGRP_BUSURPER_2211_724 {
	meta:
		description = "EQGRP Toolset Firewall - file BUSURPER-2211-724.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "d809d6ff23a9eee53d2132d2c13a9ac5d0cb3037c60e229373fc59a4f14bc744"
		id = "d109210e-14df-5b90-a496-fa8a2454126b"
	strings:
		$s1 = ".got_loader" fullword ascii
		$s2 = "_start_text" ascii
		$s3 = "IMPLANT" fullword ascii
		$s4 = "KEEPGOING" fullword ascii
		$s5 = "upgrade_implant" fullword ascii
	condition:
		all of them
}
YARA Detection Rule: EQGRP_networkProfiler_orderScans
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file networkProfiler_orderScans.sh
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$x1 = "Unable to save off predefinedScans directory" fullword ascii
		$x2 = "Re-orders the networkProfiler scans so they show up in order in the LP" fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_networkProfiler_orderScans {
	meta:
		description = "EQGRP Toolset Firewall - file networkProfiler_orderScans.sh"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "ea986ddee09352f342ac160e805312e3a901e58d2beddf79cd421443ba8c9898"
		id = "2d48df0c-f950-5bb6-8d3e-77c2f970eb57"
	strings:
		$x1 = "Unable to save off predefinedScans directory" fullword ascii
		$x2 = "Re-orders the networkProfiler scans so they show up in order in the LP" fullword ascii
	condition:
		1 of them
}
YARA Detection Rule: EQGRP_epicbanana_2_1_0_1
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file epicbanana_2.1.0.1.py
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "failed to create version-specific payload" fullword ascii
		$s2 = "(are you sure you did \"make [version]\" in versions?)" fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_epicbanana_2_1_0_1 {
	meta:
		description = "EQGRP Toolset Firewall - file epicbanana_2.1.0.1.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "4b13cc183c3aaa8af43ef3721e254b54296c8089a0cd545ee3b867419bb66f61"
		id = "cc3346bd-0347-5cf3-b946-5c017d68d93e"
	strings:
		$s1 = "failed to create version-specific payload" fullword ascii
		$s2 = "(are you sure you did \"make [version]\" in versions?)" fullword ascii
	condition:
		1 of them
}
YARA Detection Rule: EQGRP_sniffer_xml2pcap
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file sniffer_xml2pcap
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$x1 = "-s/--srcip <sourceIP>  Use given source IP (if sniffer doesn't collect source IP)" fullword ascii
		$x2 = "convert an XML file generated by the BLATSTING sniffer module into a pcap capture file." fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_sniffer_xml2pcap {
	meta:
		description = "EQGRP Toolset Firewall - file sniffer_xml2pcap"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "f5e5d75cfcd86e5c94b0e6f21bbac886c7e540698b1556d88a83cc58165b8e42"
		id = "c284ac58-923c-5c34-b420-e[PII_REDACTED]3"
	strings:
		$x1 = "-s/--srcip <sourceIP>  Use given source IP (if sniffer doesn't collect source IP)" fullword ascii
		$x2 = "convert an XML file generated by the BLATSTING sniffer module into a pcap capture file." fullword ascii
	condition:
		1 of them
}