deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: PoseidonGroup_MalDoc_1
Repository: Neo23x0/signature-base
Detects: Detects Poseidon Group - Malicious Word Document
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/

Pattern signatures:
$s1 = "c:\\cmd32dll.exe" fullword ascii

Detection condition:
uint16(0) == 0xcfd0 and filesize < 500KB and all of them

Full rule:
rule PoseidonGroup_MalDoc_1 {
	meta:
		description = "Detects Poseidon Group - Malicious Word Document"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
		date = "2016-02-09"
		score = 80
		hash = "0983526d7f0640e5765ded6be6c9e64869172a02c20023f8a006396ff358999b"
		id = "ab26455a-d468-5a75-a6e2-61701ca3a1df"
	strings:
		$s1 = "c:\\cmd32dll.exe" fullword ascii
	condition:
		uint16(0) == 0xcfd0 and filesize < 500KB and all of them
}
YARA Detection Rule: PoseidonGroup_MalDoc_2
Repository: Neo23x0/signature-base
Detects: Detects Poseidon Group - Malicious Word Document
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/

Pattern signatures:
$s0 = "{\\*\\generator Msftedit 5.41." ascii
		$s1 = "Attachment 1: Complete Professional Background" ascii
		$s2 = "E-mail:  \\cf1\\ul\\f1"
		$s3 = "Education:\\par" ascii
		$s5 = "@gmail.com" ascii

Detection condition:
uint32(0) == 0x74725c7b and filesize < 500KB and 3 of them

Full rule:
rule PoseidonGroup_MalDoc_2 {
	meta:
		description = "Detects Poseidon Group - Malicious Word Document"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
		date = "2016-02-09"
		score = 70
		hash1 = "3e4cacab0ff950da1c6a1c640fe6cf5555b99e36d4e1cf5c45f04a2048f7620c"
		hash2 = "1f77475d7740eb0c5802746d63e93218f16a7a19f616e8fddcbff07983b851af"
		hash3 = "f028ee20363d3a17d30175508bbc4738dd8e245a94bfb200219a40464dd09b3a"
		hash4 = "ec309300c950936a1b9f900aa30630b33723c42240ca4db978f2ca5e0f97afed"
		hash5 = "[PII_REDACTED]2fed64c23f583617908c8648fa4b4633bacd224f97e7f5d8b18778"
		hash6 = "1e62629dae05bf7ee3fe1346faa60e6791c61f92dd921daa5ce2bdce2e9d4216"
		id = "9fc0f25e-809d-5803-be39-740ce3a3c85a"
	strings:
		$s0 = "{\\*\\generator Msftedit 5.41." ascii
		$s1 = "Attachment 1: Complete Professional Background" ascii
		$s2 = "E-mail:  \\cf1\\ul\\f1"
		$s3 = "Education:\\par" ascii
		$s5 = "@gmail.com" ascii
	condition:
		uint32(0) == 0x74725c7b and filesize < 500KB and 3 of them
}
YARA Detection Rule: Pirpi_1609_A
Repository: Neo23x0/signature-base
Detects: Detects Pirpi Backdoor - and other malware (generic rule)
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/igxLyF

Pattern signatures:
$x1 = "expand.exe1.gif" fullword ascii

		$c1 = "expand.exe" fullword ascii
		$c2 = "ctf.exe" fullword ascii

		$s1 = "flvUpdate.exe" fullword wide
		$s2 = "www.ThinkWorking.com" fullword wide
		$s3 = "ctfnon.exe" fullword ascii
		$s4 = "flv%d.exe" fullword ascii
		$s5 = "HARDWARE\\DESCRIPTION\\System\\BIOS" fullword ascii
		$s6 = "12811[%d].gif" fullword ascii
		$s7 = "GetApp03" fullword wide
		$s8 = "flvUpdate" fullword wide
		$s9 = "%d-%4.4d%d" fullword ascii
		$s10 = "http://%s/%5.5d.html" fullword ascii
		$s11 = "flvbho.exe" fullword wide

		$op1 = { 74 08 c1 cb 0d 03 da 40 eb }
		$op2 = { 03 f5 56 8b 76 20 03 f5 33 c9 49 }
		$op3 = { 03 dd 66 8b 0c 4b 8b 5e 1c 03 dd 8b 04 8b 03 c5 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and ( $x1 or all of ($c*) or all of ($op*) ) ) or ( 8 of them )

Full rule:
rule Pirpi_1609_A {
	meta:
		description = "Detects Pirpi Backdoor - and other malware (generic rule)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/igxLyF"
		date = "2016-09-08"
		hash1 = "2a5a0bc350e774bd784fc[PII_REDACTED]6b65a3ce10c7401f44a1616ea2ae32f4c"
		hash2 = "8caa179ec20b6e3938d17132980e0b9fe8ef753a70052f7e857b339427eb0f78"
		id = "72b996e2-56cf-5a8d-8d8b-97eda7105d26"
	strings:
		$x1 = "expand.exe1.gif" fullword ascii

		$c1 = "expand.exe" fullword ascii
		$c2 = "ctf.exe" fullword ascii

		$s1 = "flvUpdate.exe" fullword wide
		$s2 = "www.ThinkWorking.com" fullword wide
		$s3 = "ctfnon.exe" fullword ascii
		$s4 = "flv%d.exe" fullword ascii
		$s5 = "HARDWARE\\DESCRIPTION\\System\\BIOS" fullword ascii
		$s6 = "12811[%d].gif" fullword ascii
		$s7 = "GetApp03" fullword wide
		$s8 = "flvUpdate" fullword wide
		$s9 = "%d-%4.4d%d" fullword ascii
		$s10 = "http://%s/%5.5d.html" fullword ascii
		$s11 = "flvbho.exe" fullword wide

		$op1 = { 74 08 c1 cb 0d 03 da 40 eb }
		$op2 = { 03 f5 56 8b 76 20 03 f5 33 c9 49 }
		$op3 = { 03 dd 66 8b 0c 4b 8b 5e 1c 03 dd 8b 04 8b 03 c5 }
	condition:
		( uint16(0) == 0x5a4d and filesize < 200KB and ( $x1 or all of ($c*) or all of ($op*) ) ) or ( 8 of them )
}
YARA Detection Rule: Pirpi_1609_B
Repository: Neo23x0/signature-base
Detects: Detects Pirpi Backdoor
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/igxLyF

Pattern signatures:
$s1 = "tconn <ip> <port> //set temp connect value, and disconnect." fullword ascii
		$s2 = "E* ListenCheckSsl SslRecv fd(%d) Error ret:%d %d" fullword ascii
		$s3 = "%s %s L* ListenCheckSsl fd(%d) SslV(-%d-)" fullword ascii
		$s4 = "S:%d.%d-%d.%d V(%d.%d) Listen On %d Ok." fullword ascii
		$s5 = "E* ListenCheckSsl fd(%d) SslAccept Err %d" fullword ascii
		$s6 = "%s-%s N110 Ssl Connect Ok(%s:%d)." fullword ascii
		$s7 = "%s-%s N110 Basic Connect Ok(%s:%d)." fullword ascii
		$s8 = "tconn <ip> <port>" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them ) or ( 4 of them )

Full rule:
rule Pirpi_1609_B {
	meta:
		description = "Detects Pirpi Backdoor"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/igxLyF"
		date = "2016-09-08"
		hash1 = "498b98c02e19f4b03dc6a3a8b6ff8761ef2c0fedda846ced4b6f1c87b52468e7"
		id = "caf63b97-efd7-5cd4-8954-b86db4d93cf5"
	strings:
		$s1 = "tconn <ip> <port> //set temp connect value, and disconnect." fullword ascii
		$s2 = "E* ListenCheckSsl SslRecv fd(%d) Error ret:%d %d" fullword ascii
		$s3 = "%s %s L* ListenCheckSsl fd(%d) SslV(-%d-)" fullword ascii
		$s4 = "S:%d.%d-%d.%d V(%d.%d) Listen On %d Ok." fullword ascii
		$s5 = "E* ListenCheckSsl fd(%d) SslAccept Err %d" fullword ascii
		$s6 = "%s-%s N110 Ssl Connect Ok(%s:%d)." fullword ascii
		$s7 = "%s-%s N110 Basic Connect Ok(%s:%d)." fullword ascii
		$s8 = "tconn <ip> <port>" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them ) or ( 4 of them )
}
YARA Detection Rule: KR_Target_Malware_Aug17
Repository: Neo23x0/signature-base
Detects: Detects malware that targeted South Korea in Aug 2017 - file MRDqsbuEqGxrgqtbXU.exe
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/eyalsela/status/[PII_REDACTED]97354240

Pattern signatures:
$x1 = { 53 00 75 00 63 00 63 00 65 00 00 2F 53 00 6F 00
               6D 00 65 00 74 00 68 00 69 00 6E 00 67 00 20 00
               77 00 65 00 6E 00 74 00 20 00 77 00 72 00 6F 00
               6E 00 67 00 }

      $x2 = "lnVMODvjSfOQQnfiuFogghlL" fullword ascii
      $x3 = "E X I T  +R U N A S  /a P P d A T A " fullword ascii
      $x4 = "uSEsHELLeXECUTE gETeNTRYaSSEMBLY GET" fullword ascii
      $x5 = "ZahUKBXz" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and
        filesize < 800KB and
        1 of them
      )

Full rule:
rule KR_Target_Malware_Aug17 {
   meta:
      description = "Detects malware that targeted South Korea in Aug 2017 - file MRDqsbuEqGxrgqtbXU.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/eyalsela/status/[PII_REDACTED]97354240"
      date = "2017-08-23"
      hash1 = "82cada01643a42c8cd9600b8c33f3760d15e5eb6fabec2d531cf13cece095c78"
      id = "2a6a7921-953a-502c-9702-b27325b2c3b8"
   strings:
      $x1 = { 53 00 75 00 63 00 63 00 65 00 00 2F 53 00 6F 00
               6D 00 65 00 74 00 68 00 69 00 6E 00 67 00 20 00
               77 00 65 00 6E 00 74 00 20 00 77 00 72 00 6F 00
               6E 00 67 00 }

      $x2 = "lnVMODvjSfOQQnfiuFogghlL" fullword ascii
      $x3 = "E X I T  +R U N A S  /a P P d A T A " fullword ascii
      $x4 = "uSEsHELLeXECUTE gETeNTRYaSSEMBLY GET" fullword ascii
      $x5 = "ZahUKBXz" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and
        filesize < 800KB and
        1 of them
      )
}
YARA Detection Rule: APT_Project_Sauron_Scripts
Repository: Neo23x0/signature-base
Detects: Detects scripts (mostly LUA) from Project Sauron report by Kaspersky
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/eFoP4A

Pattern signatures:
$x1 = "local t = w.exec2str(\"regedit "
		$x2 = "local r = w.exec2str(\"cat"
		$x3 = "ap*.txt link*.txt node*.tun VirtualEncryptedNetwork.licence"
		$x4 = "move O FakeVirtualEncryptedNetwork.dll"
		$x5 = "sinfo | basex b 32url | dext l 30"
		$x6 = "w.exec2str(execStr)"
		$x7 = "netnfo irc | basex b 32url"
		$x8 = "w.exec(\"wfw status\")"
		$x9 = "exec(\"samdump\")"
		$x10 = "cat VirtualEncryptedNetwork.ini|grep"
		$x11 = "if string.lower(k) == \"securityproviders\" then"
		$x12 = "exec2str(\"plist b | grep netsvcs\")"
		$x14 = "SAURON_KBLOG_KEY ="

Detection condition:
1 of them

Full rule:
rule APT_Project_Sauron_Scripts {
	meta:
		description = "Detects scripts (mostly LUA) from Project Sauron report by Kaspersky"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-08"
		id = "575a6f1b-5a4d-5f81-b44a-b7025dbec2a5"
	strings:
		$x1 = "local t = w.exec2str(\"regedit "
		$x2 = "local r = w.exec2str(\"cat"
		$x3 = "ap*.txt link*.txt node*.tun VirtualEncryptedNetwork.licence"
		$x4 = "move O FakeVirtualEncryptedNetwork.dll"
		$x5 = "sinfo | basex b 32url | dext l 30"
		$x6 = "w.exec2str(execStr)"
		$x7 = "netnfo irc | basex b 32url"
		$x8 = "w.exec(\"wfw status\")"
		$x9 = "exec(\"samdump\")"
		$x10 = "cat VirtualEncryptedNetwork.ini|grep"
		$x11 = "if string.lower(k) == \"securityproviders\" then"
		$x12 = "exec2str(\"plist b | grep netsvcs\")"
		$x14 = "SAURON_KBLOG_KEY ="
	condition:
		1 of them
}
YARA Detection Rule: HKTL_Dsniff
Repository: Neo23x0/signature-base
Detects: Detects Dsniff hack tool
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/eFoP4A

Pattern signatures:
$x1 = ".*account.*|.*acct.*|.*domain.*|.*login.*|.*member.*"

Detection condition:
1 of them

Full rule:
rule HKTL_Dsniff {
   meta:
      description = "Detects Dsniff hack tool"
      author = "Florian Roth (Nextron Systems)"
      score = 55
      reference = "https://goo.gl/eFoP4A"
      date = "2019-02-19"
      id = "eb39185b-330f-5b93-ac58-0465e5767919"
   strings:
      $x1 = ".*account.*|.*acct.*|.*domain.*|.*login.*|.*member.*"
   condition:
      1 of them
}
YARA Detection Rule: APT_Project_Sauron_arping_module
Repository: Neo23x0/signature-base
Detects: Detects strings from arping module - Project Sauron report by Kaspersky
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/eFoP4A

Pattern signatures:
$s1 = "Resolve hosts that answer"
		$s2 = "Print only replying Ips"
		$s3 = "Do not display MAC addresses"

Detection condition:
all of them

Full rule:
rule APT_Project_Sauron_arping_module {
	meta:
		description = "Detects strings from arping module - Project Sauron report by Kaspersky"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-08"
		id = "42389511-de92-57cb-9dee-9f829fd5e55a"
	strings:
		$s1 = "Resolve hosts that answer"
		$s2 = "Print only replying Ips"
		$s3 = "Do not display MAC addresses"
	condition:
		all of them
}
YARA Detection Rule: APT_Project_Sauron_kblogi_module
Repository: Neo23x0/signature-base
Detects: Detects strings from kblogi module - Project Sauron report by Kaspersky
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/eFoP4A

Pattern signatures:
$x1 = "Inject using process name or pid. Default"
		$s2 = "Convert mode: Read log from file and convert to text"
		$s3 = "Maximum running time in seconds"

Detection condition:
$x1 or 2 of them

Full rule:
rule APT_Project_Sauron_kblogi_module {
	meta:
		description = "Detects strings from kblogi module - Project Sauron report by Kaspersky"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-08"
		id = "e1dd4d1a-1089-5897-8f4a-52c7068802fa"
	strings:
		$x1 = "Inject using process name or pid. Default"
		$s2 = "Convert mode: Read log from file and convert to text"
		$s3 = "Maximum running time in seconds"
	condition:
		$x1 or 2 of them
}
YARA Detection Rule: APT_Project_Sauron_basex_module
Repository: Neo23x0/signature-base
Detects: Detects strings from basex module - Project Sauron report by Kaspersky
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/eFoP4A

Pattern signatures:
$x1 = "64, 64url, 32, 32url or 16."
		$s2 = "Force decoding when input is invalid/corrupt"
		$s3 = "This cruft"

Detection condition:
$x1 or 2 of them

Full rule:
rule APT_Project_Sauron_basex_module {
	meta:
		description = "Detects strings from basex module - Project Sauron report by Kaspersky"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-08"
		id = "51ef3826-af5c-562b-a1f8-3bf11532ac2d"
	strings:
		$x1 = "64, 64url, 32, 32url or 16."
		$s2 = "Force decoding when input is invalid/corrupt"
		$s3 = "This cruft"
	condition:
		$x1 or 2 of them
}
YARA Detection Rule: APT_Project_Sauron_dext_module
Repository: Neo23x0/signature-base
Detects: Detects strings from dext module - Project Sauron report by Kaspersky
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/eFoP4A

Pattern signatures:
$x1 = "Assemble rows of DNS names back to a single string of data"
		$x2 = "removes checks of DNS names and lengths (during split)"
		$x3 = "Randomize data lengths (length/2 to length)"
		$x4 = "This cruft"

Detection condition:
2 of them

Full rule:
rule APT_Project_Sauron_dext_module {
	meta:
		description = "Detects strings from dext module - Project Sauron report by Kaspersky"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-08"
		id = "d69373e0-d6ad-5475-8766-06e865620ed8"
	strings:
		$x1 = "Assemble rows of DNS names back to a single string of data"
		$x2 = "removes checks of DNS names and lengths (during split)"
		$x3 = "Randomize data lengths (length/2 to length)"
		$x4 = "This cruft"
	condition:
		2 of them
}
YARA Detection Rule: Hacktool_This_Cruft
Repository: Neo23x0/signature-base
Detects: Detects string 'This cruft' often used in hack tools like netcat or cryptcat and also mentioned in Project Sauron report
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/eFoP4A

Pattern signatures:
$x1 = "This cruft" fullword

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and $x1 )

Full rule:
rule Hacktool_This_Cruft {
	meta:
		description = "Detects string 'This cruft' often used in hack tools like netcat or cryptcat and also mentioned in Project Sauron report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-08"
		score = 60
		id = "a39de541-19b5-5b7e-a3dc-51a5309181e5"
	strings:
		$x1 = "This cruft" fullword
	condition:
		( uint16(0) == 0x5a4d and filesize < 200KB and $x1 )
}
YARA Detection Rule: APT_Project_Sauron_Custom_M1
Repository: Neo23x0/signature-base
Detects: Detects malware from Project Sauron APT
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/eFoP4A

Pattern signatures:
$s1 = "ncnfloc.dll" fullword wide
		$s4 = "Network Configuration Locator" fullword wide

		$op0 = { 80 75 6e 85 c0 79 6a 66 41 83 38 0a 75 63 0f b7 } /* Opcode */
		$op1 = { 80 75 29 85 c9 79 25 b9 01 } /* Opcode */
		$op2 = { 2b d8 48 89 7c 24 38 44 89 6c 24 40 83 c3 08 89 } /* Opcode */

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and ( all of ($s*) ) and 1 of ($op*) ) or ( all of them )

Full rule:
rule APT_Project_Sauron_Custom_M1 {
	meta:
		description = "Detects malware from Project Sauron APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-09"
		hash1 = "9572624b6026311a0e122835bcd7200eca396802000d0777dba118afaaf9f2a9"
		id = "c741bd7d-1885-55f1-a5b3-8f00fda2fe39"
	strings:
		$s1 = "ncnfloc.dll" fullword wide
		$s4 = "Network Configuration Locator" fullword wide

		$op0 = { 80 75 6e 85 c0 79 6a 66 41 83 38 0a 75 63 0f b7 } /* Opcode */
		$op1 = { 80 75 29 85 c9 79 25 b9 01 } /* Opcode */
		$op2 = { 2b d8 48 89 7c 24 38 44 89 6c 24 40 83 c3 08 89 } /* Opcode */
	condition:
		( uint16(0) == 0x5a4d and filesize < 200KB and ( all of ($s*) ) and 1 of ($op*) ) or ( all of them )
}
YARA Detection Rule: APT_Project_Sauron_Custom_M2
Repository: Neo23x0/signature-base
Detects: Detects malware from Project Sauron APT
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/eFoP4A

Pattern signatures:
$s2 = "\\*\\3vpn" ascii

		$op0 = { 55 8b ec 83 ec 0c 53 56 33 f6 39 75 08 57 89 75 } /* Opcode */
		$op1 = { 59 59 c3 8b 65 e8 ff 75 88 ff 15 50 20 40 00 ff } /* Opcode */
		$op2 = { 8b 4f 06 85 c9 74 14 83 f9 12 0f 82 a7 } /* Opcode */

Detection condition:
( uint16(0) == 0x5a4d and filesize < 400KB and ( all of ($s*) ) and all of ($op*) )

Full rule:
rule APT_Project_Sauron_Custom_M2 {
	meta:
		description = "Detects malware from Project Sauron APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-09"
		hash1 = "30a824155603c2e9d8bfd3adab8660e826d7e0681e28e46d102706a03e23e3a8"
		id = "79abe5f2-a750-5018-a67f-6ee1c51a2ca1"
	strings:
		$s2 = "\\*\\3vpn" ascii

		$op0 = { 55 8b ec 83 ec 0c 53 56 33 f6 39 75 08 57 89 75 } /* Opcode */
		$op1 = { 59 59 c3 8b 65 e8 ff 75 88 ff 15 50 20 40 00 ff } /* Opcode */
		$op2 = { 8b 4f 06 85 c9 74 14 83 f9 12 0f 82 a7 } /* Opcode */
	condition:
		( uint16(0) == 0x5a4d and filesize < 400KB and ( all of ($s*) ) and all of ($op*) )
}
YARA Detection Rule: APT_Project_Sauron_Custom_M3
Repository: Neo23x0/signature-base
Detects: Detects malware from Project Sauron APT
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/eFoP4A

Pattern signatures:
$s1 = "ExampleProject.dll" fullword ascii

		$op0 = { 8b 4f 06 85 c9 74 14 83 f9 13 0f 82 ba } /* Opcode */
		$op1 = { ff 15 34 20 00 10 85 c0 59 a3 60 30 00 10 75 04 } /* Opcode */
		$op2 = { 55 8b ec ff 4d 0c 75 09 ff 75 08 ff 15 00 20 00 } /* Opcode */

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and ( all of ($s*) ) and all of ($op*) )

Full rule:
rule APT_Project_Sauron_Custom_M3 {
	meta:
		description = "Detects malware from Project Sauron APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-09"
		hash1 = "a4736de88e9208eb81b52f29bab9e7f328b90a86512bd0baadf4c519e948e5ec"
		id = "555b37a2-6a3c-539f-81dc-24c739795510"
	strings:
		$s1 = "ExampleProject.dll" fullword ascii

		$op0 = { 8b 4f 06 85 c9 74 14 83 f9 13 0f 82 ba } /* Opcode */
		$op1 = { ff 15 34 20 00 10 85 c0 59 a3 60 30 00 10 75 04 } /* Opcode */
		$op2 = { 55 8b ec ff 4d 0c 75 09 ff 75 08 ff 15 00 20 00 } /* Opcode */
	condition:
		( uint16(0) == 0x5a4d and filesize < 1000KB and ( all of ($s*) ) and all of ($op*) )
}
YARA Detection Rule: APT_Project_Sauron_Custom_M4
Repository: Neo23x0/signature-base
Detects: Detects malware from Project Sauron APT
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/eFoP4A

Pattern signatures:
$s1 = "xpsmngr.dll" fullword wide
		$s2 = "XPS Manager" fullword wide

		$op0 = { 89 4d e8 89 4d ec 89 4d f0 ff d2 3d 08 00 00 c6 } /* Opcode */
		$op1 = { 55 8b ec ff 4d 0c 75 09 ff 75 08 ff 15 04 20 5b } /* Opcode */
		$op2 = { 8b 4f 06 85 c9 74 14 83 f9 13 0f 82 b6 } /* Opcode */

Detection condition:
( uint16(0) == 0x5a4d and filesize < 90KB and ( all of ($s*) ) and 1 of ($op*) ) or ( all of them )

Full rule:
rule APT_Project_Sauron_Custom_M4 {
	meta:
		description = "Detects malware from Project Sauron APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-09"
		hash1 = "e12e66a6127cfd2cbb42e6f0d57c9dd019b02768d6f1fb44d91f12d90a611a57"
		id = "32717ace-ff56-5b5b-8ed9-4bb353886eea"
	strings:
		$s1 = "xpsmngr.dll" fullword wide
		$s2 = "XPS Manager" fullword wide

		$op0 = { 89 4d e8 89 4d ec 89 4d f0 ff d2 3d 08 00 00 c6 } /* Opcode */
		$op1 = { 55 8b ec ff 4d 0c 75 09 ff 75 08 ff 15 04 20 5b } /* Opcode */
		$op2 = { 8b 4f 06 85 c9 74 14 83 f9 13 0f 82 b6 } /* Opcode */
	condition:
		( uint16(0) == 0x5a4d and filesize < 90KB and ( all of ($s*) ) and 1 of ($op*) ) or ( all of them )
}
YARA Detection Rule: APT_Project_Sauron_Custom_M6
Repository: Neo23x0/signature-base
Detects: Detects malware from Project Sauron APT
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/eFoP4A

Pattern signatures:
$s1 = "rseceng.dll" fullword wide
		$s2 = "Remote Security Engine" fullword wide

		$op0 = { 8b 0d d5 1d 00 00 85 c9 0f 8e a2 } /* Opcode */
		$op1 = { 80 75 6e 85 c0 79 6a 66 41 83 38 0a 75 63 0f b7 } /* Opcode */
		$op2 = { 80 75 29 85 c9 79 25 b9 01 } /* Opcode */

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and ( all of ($s*) ) and 1 of ($op*) ) or ( all of them )

Full rule:
rule APT_Project_Sauron_Custom_M6 {
	meta:
		description = "Detects malware from Project Sauron APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-09"
		hash1 = "3782b63d7f6f688a5ccb1b72be89a6a98bb722218c9f22402709af97a41973c8"
		id = "1aa6dd43-52ac-5321-9[PII_REDACTED]73c37"
	strings:
		$s1 = "rseceng.dll" fullword wide
		$s2 = "Remote Security Engine" fullword wide

		$op0 = { 8b 0d d5 1d 00 00 85 c9 0f 8e a2 } /* Opcode */
		$op1 = { 80 75 6e 85 c0 79 6a 66 41 83 38 0a 75 63 0f b7 } /* Opcode */
		$op2 = { 80 75 29 85 c9 79 25 b9 01 } /* Opcode */
	condition:
		( uint16(0) == 0x5a4d and filesize < 200KB and ( all of ($s*) ) and 1 of ($op*) ) or ( all of them )
}